Visit  our  website  for  other  free  publication 
downloads 

http :  /  /  www  .StrategicStudiesInstitute  .army  .mil  / 


To  rate  this  publication  click  here. 


MAKING  STRATEGIC  SENSE 
OF  CYBER  POWER; 

WHY  THE  SKY  IS  NOT  FALLING 


Colin  S.  Gray  U.S.  ARMY  WAR  COLLEGE 


STRATEGIC  STUDIES  INSTITUTE 


Report  Documentation  Page 

Form  Approved 

OMB  No.  0704-0188 

Public  reporting  burden  for  the  collection  of  information  is  estimated  to  average  1  hour  per  response,  including  the  time  for  reviewing  instructions,  searching  existing  data  sources,  gathering  and 
maintaining  the  data  needed,  and  completing  and  reviewing  the  collection  of  information.  Send  comments  regarding  this  burden  estimate  or  any  other  aspect  of  this  collection  of  information, 
including  suggestions  for  reducing  this  burden,  to  Washington  Headquarters  Services,  Directorate  for  Information  Operations  and  Reports,  1215  Jefferson  Davis  Highway,  Suite  1204,  Arlington 

VA  22202-4302.  Respondents  should  be  aware  that  notwithstanding  any  other  provision  of  law,  no  person  shall  be  subject  to  a  penalty  for  failing  to  comply  with  a  collection  of  information  if  it 
does  not  display  a  currently  valid  OMB  control  number. 

1.  REPORT  DATE 

APR  2013  2.  REPORT  TYPE 

3.  DATES  COVERED 

00-00-2013  to  00-00-2013 

4.  TITLE  AND  SUBTITLE 

Making  Strategic  Sense  of  Cyber  Power:  Why  the  Sky  is  Not  Falling 

5a.  CONTRACT  NUMBER 

5b.  GRANT  NUMBER 

5c.  PROGRAM  ELEMENT  NUMBER 

6.  AUTHOR(S) 

5d.  PROTECT  NUMBER 

5e.  TASK  NUMBER 

5f.  WORK  UNIT  NUMBER 

7.  PERFORMING  ORGANIZATION  NAME(S)  AND  ADDRESS(ES) 

U.S.  Army  War  College, Strategic  Studies  Institute, 47  Ashburn 

Drive, Carlisle, PA, 17013-5010 

8.  PERFORMING  ORGANIZATION 

REPORT  NUMBER 

9.  SPONSORING/MONITORING  AGENCY  NAME(S)  AND  ADDRESS(ES) 

10.  SPONSOR/MONITOR'S  ACRONYM(S) 

11.  SPONSOR/MONITOR'S  REPORT 
NUMBER(S) 

12.  DISTRIBUTION/AVAILABILITY  STATEMENT 

Approved  for  public  release;  distribution  unlimited 

13.  SUPPLEMENTARY  NOTES 

14.  ABSTRACT 

15.  SUBIECT  TERMS 

16.  SECURITY  CLASSIFICATION  OF:  17.  LIMITATION  OF 

_ _ _  ABSTRACT 

18.  NUMBER  19a.  NAME  OF 

OF  PAGES  RESPONSIBLE  PERSON 

a.  REPORT  b.  ABSTRACT  c.  THIS  PAGE  Same  OS 

unclassified  unclassified  unclassified  Report  (SAR) 

83 

Standard  Form  298  (Rev.  8-98) 

Prescribed  by  ANSI  Std  Z39-18 


STRATEGIC 

STUDIES 

INSTITUTE 


The  Strategic  Studies  Institute  (SSI)  is  part  of  the  U.S.  Army  War 
College  and  is  the  strategic-level  study  agent  for  issues  related  to 
national  security  and  military  strategy  with  emphasis  on  geostrate¬ 
gic  analysis. 

The  mission  of  SSI  is  to  use  independent  analysis  to  conduct  strategic 
studies  that  develop  policy  recommendations  on: 

•  Strategy,  planning,  and  policy  for  joint  and  combined 
employment  of  military  forces; 

•  Regional  strategic  appraisals; 

•  The  nature  of  land  warfare; 

•  Matters  affecting  the  Army's  future; 

•  The  concepts,  philosophy,  and  theory  of  strategy;  and 

•  Other  issues  of  importance  to  the  leadership  of  the  Army. 

Studies  produced  by  civilian  and  military  analysts  concern  topics 
having  strategic  implications  for  the  Army,  the  Department  of  De¬ 
fense,  and  the  larger  national  security  community. 

In  addition  to  its  studies,  SSI  publishes  special  reports  on  topics  of 
special  or  immediate  interest.  These  include  edited  proceedings  of 
conferences  and  topically-oriented  roundtables,  expanded  trip  re¬ 
ports,  and  quick-reaction  responses  to  senior  Army  leaders. 

The  Institute  provides  a  valuable  analytical  capability  within  the 
Army  to  address  strategic  and  other  issues  in  support  of  Army  par¬ 
ticipation  in  national  security  policy  formulation. 


Strategic  Studies  Institute 
and 

U.S.  Army  War  College  Press 


MAKING  STRATEGIC  SENSE  OF  CYBER  POWER: 
WHY  THE  SKY  IS  NOT  FALLING 


Colin  S.  Gray 


April  2013 


The  views  expressed  in  this  report  are  those  of  the  author  and 
do  not  necessarily  reflect  the  official  policy  or  position  of  the 
Department  of  the  Army,  the  Department  of  Defense,  or  the 
U.S.  Government.  Authors  of  Strategic  Studies  Institute  and 
U.S.  Army  War  College  Press  publications  enjoy  full  academic 
freedom,  provided  they  do  not  disclose  classified  information, 
jeopardize  operations  security,  or  misrepresent  official  U.S. 
policy.  Such  academic  freedom  empowers  them  to  offer  new  and 
sometimes  controversial  perspectives  in  the  interest  of  furthering 
debate  on  key  issues. 


•klekiek 


This  publication  is  subject  to  Title  17,  United  States  Code, 
Sections  101  and  105.  It  is  in  the  public  domain  and  may  not  be 
copyrighted. 


***** 


Comments  pertaining  to  this  report  are  invited  and  should 
be  forwarded  to:  Director,  Strategic  Studies  Institute  and  U.S. 
Army  War  College  Press,  U.S.  Army  War  College,  47  Ashburn 
Drive,  Carlisle,  PA  17013-5010. 


***** 


All  Strategic  Studies  Institute  (SSI)  and  U.S.  Army  War 
College  Press  (USAWC)  publications  may  be  downloaded 
free  of  charge  from  the  SSI  website.  Hard  copies  of  this  re¬ 
port  may  also  be  obtained  free  of  charge  while  supplies  last  by 
placing  an  order  on  the  SSI  website.  SSI  publications  may  be 
quoted  or  reprinted  in  part  or  in  full  with  permission  and  ap¬ 
propriate  credit  given  to  the  U.S.  Army  Strategic  Studies  Insti¬ 
tute  and  USAWC  Press,  U.S.  Army  War  College,  Carlisle,  PA. 
Contact  SSI  by  visiting  our  website  at  the  following  address: 
www.StrategicStudiesInstitute.army.mil. 

***** 


The  Strategic  Studies  Institute  and  USAWC  Press 
publishes  a  monthly  e-mail  newsletter  to  update  the  national 
security  community  on  the  research  of  our  analysts,  recent  and 
forthcoming  publications,  and  upcoming  conferences  sponsored 
by  the  Institute.  Each  newsletter  also  provides  a  strategic  com¬ 
mentary  by  one  of  our  research  analysts.  If  you  are  interested  in 
receiving  this  newsletter,  please  subscribe  on  the  SSI  website  at 
www.StrategicStudiesInstitute.army.mil/newsletter/. 

***** 


I  would  like  to  acknowledge  Group  Captain  Shaun  Harvey 
of  the  Royal  Air  Force  (RAF)  for  his  educational  assistance  to  me 
in  my  preparation  of  this  monograph.  However,  he  is  not  at  all 
responsible  for  the  use  that  I  have  chosen  to  make  of  his  knowl¬ 
edge  and  advice. 


ISBN  1-58487-564-X 


FOREWORD 


Cyber  is  now  recognized  as  an  operational  do¬ 
main,  but  the  theory  that  should  explain  it  strategi¬ 
cally  is  very  largely  missing.  As  the  military  establish¬ 
ment  accepted  the  revolution  in  military  affairs  as  the 
big  organizing  idea  of  the  1990s,  then  moved  on  to 
transformation  in  the  early-2000s,  so  the  third  really 
big  idea  of  the  post-Cold  War  Era  began  to  secure  trac¬ 
tion-cyber.  However,  it  is  one  thing  to  know  how  to 
digitize;  it  is  quite  another  to  understand  what  digiti¬ 
zation  means  strategically. 

With  respect  to  cyber  power,  Dr.  Cohn  Gray  poses 
and  seeks  to  answer  the  most  basic  of  the  strategist's 
questions,  "So  what?"  He  notes  that  the  technical  and 
even  tactical  literature  on  cyber  is  as  abundant  as  the 
strategic  theoretical  treatment  is  both  thin  and  poor. 
However,  strategic  sense  can  be  made  of  our  limited 
cyber  experience.  Gray  argues  that  the  general  theory 
of  strategy  has  authority  over  the  cyber  domain  as  the 
fifth  geography  of  war,  even  though  physical  "force" 
cannot  be  generated  directly  by  networked  comput¬ 
ers.  Cyber  power  is  not  to  be  compared  usefully  with 
nuclear  weapons;  analyses  that  suggest  or  imply 
catastrophic  perils  from  hostile  cyber  action  are  thor¬ 
oughly  unconvincing.  Cyber  is  an  important  enabler, 
a  team  player,  in  joint  operations.  As  a  constructed 
environment,  cyberspace(s)  is  very  much  what  we 
choose  to  make  it. 


E  EE,  JR. 

Director 


Strategic  Studies  Institute  and 


U.S.  Army  War  College  Press 


in 


ABOUT  THE  AUTHOR 


COLIN  S.  GRAY  is  Professor  of  International  Politics 
and  Strategic  Studies  at  the  University  of  Reading, 
England.  He  worked  at  the  International  Institute  for 
Strategic  Studies  (London)  and  at  the  Hudson  Institute 
(Croton-on-Hudson,  NY)  before  founding  the  Nation¬ 
al  Institute  for  Public  Policy,  a  defense-oriented  think 
tank  in  the  Washington,  DC,  area.  Dr.  Gray  served  for 
5  years  in  the  Ronald  Reagan  administration  on  the 
President's  General  Advisory  Committee  on  Arms 
Control  and  Disarmament.  He  has  served  as  an  ad¬ 
viser  to  both  the  U.S.  and  British  governments  (he  has 
dual  citizenship).  His  government  work  has  included 
studies  of  nuclear  strategy,  arms  control,  maritime 
strategy,  space  strategy,  and  the  use  of  special  forces. 
Dr.  Gray  has  written  25  books,  including:  The  Sheriff: 
America's  Defense  of  the  New  World  Order  (University 
Press  of  Kentucky,  2004);  Another  Bloody  Century:  Fu¬ 
ture  Warfare  (Weidenfeld  and  Nicolson,  2005);  Strategy 
and  History:  Essays  on  Theory  and  Practice  (Routledge, 
2006);  Fighting  Talk:  Forty  Maxims  on  War,  Peace  and 
Strategy  (Potomac  Books,  2009);  National  Security  Di¬ 
lemmas:  Challenges  and  Opportunities  (Potomac  Books, 
2009);  The  Strategy  Bridge:  Theory  for  Practice  (Oxford 
University  Press,  2010);  War,  Peace  and  International 
Relations:  An  Introduction  to  Strategic  History,  2nd  Ed. 
(Routledge,  2011);  Airpower  for  Strategic  Effect  (Air 
University  Press,  2012);  and  Perspectives  on  Strategy 
(Oxford  University  Press,  2013),  which  is  the  follow¬ 
up  to  Strategy  Bridge.  Dr.  Gray  is  a  graduate  of  the  Uni¬ 
versities  of  Manchester  and  Oxford. 


V 


SUMMARY 


Generically  viewed,  the  challenge  that  cyber  pow¬ 
er  poses  to  our  understanding  is  a  familiar  one.  After 
all,  within  living  memory  (just  about)  we  have  had  to 
try  and  make  sense  of  air  power,  and  then,  a  genera¬ 
tion  later,  of  nuclear  weapons  and  their  possible  de¬ 
livery  by  ballistic  missiles.  What  unites  our  experience 
with  air  power,  nuclear  weapons,  and  now  cyber,  is 
the  authority  of  strategic  explanation  conveyed  in  the 
general  theory  of  strategy  —  Carl  von  Clausewitz's 
rules,  even  though  he  was  ignorant  of  hydrogen  fu¬ 
sion  weapons  and  of  networked  digital  computers. 

Our  challenge  is  the  need  both  to  be  thoroughly 
respectful  of  the  science  and  engineering  that  gener¬ 
ates  the  technology  for  cyber,  while  at  the  same  time 
declining  to  be  so  dazzled  by  the  technical  wonders 
that  are  ours  to  command  that  we  are  unable  to  look 
beyond  technology  and  tactics.  To  date,  the  networked 
computer  has  fueled  a  large  library  on  the  technology 
and  the  tactics  of  the  emerging  digital  age,  but  very 
little  of  lasting  note  on  the  strategic  meaning  of  it  all. 
Senior  people  in  the  ranks  of  strategic  studies  have  by 
and  large  ignored  the  growing  cyber  challenge,  while 
those  who  are  technically  highly  cyber  knowledgeable 
typically  have  scant  background  in  strategy.  On  the 
one  hand,  those  who  are  technically  competent  have 
not  been  sufficiently  strategically  educated  to  know 
how  to  think  about  cyber  strategically.  On  the  other, 
those  who  have  some  serious  credentials  as  strategic 
thinkers  have  been  deterred  both  by  their  uncertain 
technical  grasp  of  cyber  and  — it  needs  to  be  said  — by 
the  more  pressing  demands  of  other  strategic  challeng¬ 
es.  In  the  2000s,  cyber  has  been  "coming,"  but  it  has 
not  been  urgent  in  its  need  for  attention  today,  unlike 
the  problems  associated  more  directly  with  terrorism 


and  insurgency.  Regarded  historically,  the  American 
extended  defense  community  strives  to  cope  seriatim 
with  the  biggest  issue  of  "now."  As  counterterror¬ 
ism  (CT)  and  counterinsurgency  (COIN)  have  more 
than  somewhat  faded  from  the  high  official  interest 
of  very  recent  years,  so,  predictably,  there  has  been 
opportunity  for  the  next  new  big  conceptual  challenge 
to  dominate  conference  and  seminar  agendas  — cyber. 

The  revolution  in  military  affairs  (RMA)  theory  of 
the  1990s  (and  the  transformation  theory  that  succeed¬ 
ed  it)  was  always  strategy-  and  politics-light.  It  is  not 
exactly  surprising  that  the  next  major  intellectual  chal¬ 
lenge,  that  of  cyber,  similarly  should  attract  analysis 
and  assessment  almost  entirely  naked  of  political  and 
strategic  meaning.  Presumably,  many  people  believed 
that  "doing  it"  was  more  important  than  thinking 
about  why  one  should  be  doing  it.  Anyone  who  seeks 
to  think  strategically  is  obliged  to  ask  "so  what"  of  his 
or  her  subject  of  current  concern.  But,  the  cyber  revo¬ 
lution  did  not  arrive  with  three  bangs,  in  a  manner 
closely  analogous  to  the  atomic  fact  of  the  summer  of 
1945;  instead  it  ambled,  then  galloped  forward  over  a 
25-year  period,  with  most  of  us  adapting  to  it  in  detail. 
When  historians  in  the  future  seek  to  identify  a  clas¬ 
sic  book  or  two  on  cyber  power  written  in  the  1990s 
and  2000s,  they  will  be  hard  pressed  to  locate  even  the 
shortest  of  short-listable  items.  There  are  three  or  four 
books  that  appear  to  have  unusual  merit,  but  they  are 
not  conceptually  impressive.  Certainly  they  are  no¬ 
where  near  deserving  (oxymoronic)  instant  classic  sta¬ 
tus.  It  is  important  that  cyber  should  be  understood  as 
just  another  RMA,  because  it  is  possible  to  make  help¬ 
ful  sense  of  it  in  that  context.  Above  all  else,  perhaps, 
RMA  identification  enables  us  to  place  cyber  where  it 
belongs,  in  the  grand  narrative  of  strategic  history. 
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In  addition  to  thinking  about  cyber  in  the  context 
of  the  general  theory  of  strategy,  also  it  is  enlighten¬ 
ing  to  consider  cyber  in  the  contexts  of  geography  and 
information.  Much  of  the  unhelpful  undue  technicism 
about  cyber  is  suitably  sidelined  when  the  networked 
computer  and  its  cyberspaces  are  framed  both  geo¬ 
graphically  and  as  only  the  latest  stage  in  the  eternal 
and  ubiquitous  story  of  information.  To  approach 
cyber  thus  is  not  to  demote  or  demean  it;  rath¬ 
er  it  is  simply  to  locate  cyber  properly  in  our 
relevant  universe. 

Argument  by  historical  analogy  is  commonplace 
and  essential  —  indeed,  it  is  unavoidable  —  history  is 
our  sole  source  of  evidence.  We  cannot  help  but  argue 
from  what  we  know  to  what  we  do  not  (and  cannot) 
know.  It  is  helpful  to  consider  cyber  with  reference 
to  its  prospective  utility  in  terms  of  net  assessment, 
and  to  resort  to  analogical  thinking  strategically  and 
tactically  — being  suitably  respectful  of  the  critical  dis¬ 
tinctions  between  them.  In  strategic  analogy,  cyber  is 
entirely  familiar.  If  we  are  able  to  think  strategically 
about  Landpower,  sea  power,  air  power,  and  Earth- 
orbital  space  power,  ipso  facto  we  can  think  strategi¬ 
cally  about  cyber  with  its  electrons.  Cyberspace  does 
not  pose  a  challenge  to  the  theory  of  strategy. 

But  efforts  to  think  tactically  by  analogy  about 
cyber  are  certain  to  be  seriously  misleading  and  prob¬ 
ably  disastrously  wrong.  Cyber  is  as  different  from 
the  military  power  of  the  other  geographical  domains 
as  they  are  from  each  other.  Indeed,  because  of  the 
nonphysicality  of  cyber  power  (though  not  of  the  cy¬ 
ber  infrastructure  and  its  human  operators),  this  fifth 
domain  is  unique  technically  and  tactically.  The  chal¬ 
lenge  to  understanding  is  the  necessity  for  us  to  be 
fully  respectful  of  the  distinctive  "grammar"  of  cyber, 
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without  falsely  assigning  similarly  unique  meaning  to 
its  policy  and  strategy  "logic."1 

Four  broad  conclusions  are  compelling  at  this  time. 
First,  cyber  power  will  prove  most  useful  (or  danger¬ 
ous,  as  enemy  cyber  power)  as  an  enabler  of  joint  mili¬ 
tary  operations.  Horror  scenarios  of  stand-alone  (mis¬ 
called  "strategic")  cyber  attacks  are  not  persuasive. 
The  United  States  should  expect  its  cyber  assets  to  be 
harmed  in  conflict,  but,  if  they  are  disrupted  as  antici¬ 
pated,  the  country  will  repair,  recover,  and  fight  on.  A 
like  judgment  applies  to  our  Landpower,  sea  power, 
air  power,  and  space  power. 

Second,  while  it  is  probably  true  to  claim  that  for 
technical  reasons,  cyber  offense  usually  is  likely  to 
achieve  some  success,  it  is  probably  more  significant 
that  the  harm  we  suffer  is  most  unlikely  to  be  close 
to  lethally  damaging.  Thanks  to  the  technology  that 
makes  cyberspaces,  our  discretion  in  the  re-creation 
of  cyberspace  should  present  our  enemies  with  un- 
solvable  problems.  Cyber  offense  is  swift,  but  it  is 
not  likely  to  be  deadly,  and  it  should  not  work  twice. 
Cyber  defense  ought  to  prove  good  enough. 

Third,  it  is  sensible  to  try  and  remember  that  cyber 
power  is  only  information.  Moreover,  cyber  is  only 
one  among  many  ways  in  which  we  collect,  store,  and 
transmit  information.  As  if  that  were  not  contextual 
caveat  enough,  it  is  important  to  recognize  that  there 
is  a  great  deal  more  to  conflict  and  actual  warfare  than 
information,  no  matter  what  the  tools  for  gathering 
and  transmitting  data  may  be.  From  the  beginning  of 
time,  armies  have  clashed  in  relative  ignorance.  This  is 
not  to  demean  the  value  of  information,  but  to  remind 
ourselves  that  information,  even  knowledge  (or  its  ab¬ 
sence),  is  not  a  wholly  reliable  key  to  strategic  success 
or  failure. 


Fourth,  overall,  despite  the  acute  shortage  of  care¬ 
ful  strategic  thought  on  the  subject,  and  notwithstand¬ 
ing  the  "Cybergeddon"  catastrophe  scenarios  that  sell 
media  products,  it  is  clear  enough  today  that  the  sky 
is  not  falling  because  of  cyber  peril.  The  fundamen¬ 
tal  reason  we  can  be  confident  about  this  is  that  cyber 
power,  ours  and  theirs,  is  ruled  by  the  general  theory 
of  strategy.  Once  we  shed  our  inappropriate  awe  of 
the  scientific  and  technological  novelty  and  wonder 
of  it  all,  we  ought  to  have  little  trouble  realizing  that, 
as  a  strategic  challenge,  we  have  met  and  succeeded 
against  the  like  of  networked  computers  and  their 
electrons  before.  The  whole  record  of  strategic  history 
says:  Be  respectful  of,  and  adapt  for,  technical  change, 
but  do  not  panic. 

ENDNOTES 

1.  Carl  von  Clausewitz,  On  War,  Michael  Howard  and  Peter 
Paret,  eds.  and  trans.,  Princeton,  NJ:  Princeton  University  Press, 
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MAKING  STRATEGIC  SENSE  OF  CYBER  POWER: 
WHY  THE  SKY  IS  NOT  FALLING 


Strategic  thought  on  cyberwar,  on  hostile  action  in 
cyberspace,  is  in  its  infancy. 

Elinor  C.  Sloan,  20121 

No  comparable  [to  Bernard  Brodie's  edited  1946  book, 
77ze  Absolute  Weapon:  Atomic  Power  and  World  Order] 
comprehensive  assessment  of  the  impact  of  cyberwar¬ 
fare  capabilities  exists.  Outside  the  slowly  emerging 
policy  literature  there  is  limited  scholarly  work  on  the 
topic,  leaving  important  theoretical  questions  unex¬ 
amined. 


Adam  P.  Liff,  20122 

The  rules  of  conduct  for  the  use  of  code  are  evolving. 
As  parties  develop  more  sophisticated  capabilities  and 
acquire  experience  in  their  use,  the  picture  will  grow 
more  complicated  and  nuanced.  The  strategic  situation 
contains  echoes  of  the  period  between  the  two  world 
wars,  when  rapid  developments  in  new  technologies 
and  domains  of  war-fighting  preceded  an  understand¬ 
ing  of  how  effectively  to  employ  them  operationally. 

James  P.  Farwell  and 
Rafal  Rohozinski,  20123 

To  ask  whether  cyberspace  is  the  new  high  ground  is 
just  the  latest  version  of  the  age-old  question:  which 
medium  dominates  war? 


Martin  C.  Libicki,  20074 

INTRODUCTION:  THE  CHALLENGE 

The  core  question  of  the  strategist  is  "So  what?" 
Because  strategy  is  all  about  the  consequences  of  the 
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threat  or  use  of  military  (and  other,  for  grand  strat¬ 
egy)  means  for  political  ends,  the  strategist  must  al¬ 
ways  ask  what  difference  would  possible  ways  and 
available  means  make  to  the  course  of  events.  There 
can  be  an  agreeable  ambiguity  about  "So  what?"  since 
the  meaning  of  the  spoken  words  is  conveyed  only  by 
tone  of  voice,  given  the  unavoidable  absence  of  a  clari¬ 
fying  question  or  exclamation  mark.  The  "So  what?" 
question  is  central  to  this  analysis,  because  this  strate¬ 
gist  admits  to  having  expressed  the  words  frequently 
in  both  their  recent  meanings  when  striving  to  unrav¬ 
el  the  mysteries  of  cyber.  The  purpose  here  is  to  seek 
to  provide  an  answer  to  the  strategist's  "So  what?" 
question.  What  does  cyber  power  mean  strategically? 
What  difference  will  it  make  to  the  course  of  strategic 
(and  other)  history? 

My  mission  should  be  feasible  for  at  least  two  sig¬ 
nificant  reasons.  First,  I  am  able  to  draw  heavily  upon 
the  understanding  achieved  by  the  scholars  who  have 
been  grappling  with  many  aspects  of  the  cyber  chal¬ 
lenge  over  the  past  20  years.  Second,  much  of  the  nov¬ 
elty  of  cyber  becomes  rather  less  mysterious  when  it  is 
contextualized  historically.  Indeed,  it  is  a  major  chal¬ 
lenge  for  this  analysis  to  contextualize  accurately  the 
information  technology  (IT)  revolution  of  cyber,  with¬ 
out  inadvertently  appearing  to  understate  the  quantity 
and  quality  of  very  recent  and  contemporary  change. 
Nonetheless,  it  is  essential  for  the  understanding  of 
cyber  that  it  should  be  located  in  strategic  history.  We 
humans  have  a  habit  of  allowing  the  latest  technologi¬ 
cal  marvels  to  overwhelm  our  more  critical  strategic 
sense.  Enthusiasts  for  the  new  technology  with  mili¬ 
tary  application,  direct  or  indirect,  have  a  long  history 
of  perceiving  the  objects  of  their  favor  as  the  termi¬ 
nating  move  in  a  game  of  strategy  that  has  blighted 
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the  past.  The  "revolution"  of  the  day  is  expected  to 
provide  the  technical  means  to  reduce  adversaries  to 
helpless  victims,  as  conflict  ceases  meaningfully  to  be 
a  duel. 

There  has  long  been  a  debate  over  the  important  is¬ 
sue  of  whether  ideas  direct,  or  at  least  shape,  military 
practice,  or  whether  military  practice  provides  most  of 
the  fuel  for  ideas.  This  is  not  so  much  an  academic  con¬ 
troversy  over  the  interpretation  of  historical  evidence, 
but  rather  fuel  for  policy  dispute  today.  The  immatu¬ 
rity  of  strategic  theory  for  cyber  typically  is  accepted 
as  an  inevitable  and  none-too-troubling  consequence 
of  its  novelty.  An  understanding  of  what  cyber  power 
means  strategically  is  expected,  somewhat  compla¬ 
cently,  to  emerge  once  the  practice  of  cyber  conflict 
yields  evidence  of  what  is  and  is  not  possible.  I  believe 
that  a  relaxed  attitude  toward  the  strategic  meaning  of 
cyber  is  neither  prudent  nor  necessary.  The  historical 
record  of  the  relationship  between  muscle  and  brain 
is  more  than  a  little  mixed.5  Certainly,  however,  it  is 
not  the  case  that  very  typically,  let  alone  universally, 
theory  was  written  up  to  explain  what  the  practical 
people  had  found  to  be  good  enough  practice.  Theory 
and  doctrine  asserting  authoritatively  what  is  be¬ 
lieved  to  be  the  best  practice  has  led  practice  as  often 
as  vice  versa.  But,  the  relationship  between  military 
theory  and  military  practice  is  truly  a  complex  one, 
with  theory  and  practice  comprising  essentially  a  sin¬ 
gle  unified  subject.  Theory,  be  it  general  strategic,  or 
military-specific  (i.e.,  for  Landpower,  sea  power,  air 
power,  space  power  and  now  also  cyber  power  — at 
the  environment  level),  is  always  about  strategic  and 
military  practice.  When  theory  and  doctrine  do  not 
adapt  in  the  light  of  the  actual  experience  of  conflict, 
they  are  in  a  pathological  condition. 
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The  relationship  between  theory  and  practice  is 
important  for  this  study  because  the  evidence  of  cy¬ 
ber  war  is  entirely  absent  thus  far.  Cyber  war,  needing 
careful  definition,  may  be  "coming,"  as  John  Arquilla 
and  David  Ronfeldt  claimed  in  an  exciting  article  in 
1993,  but  it  has  not  come  yet.6  Unfriendly  cyber  ac¬ 
tivity  there  has  been  and  is  in  abundance,  but  state- 
to-state  computer  network  attacks  there  have  not 
been.  Espionage,  yes,  of  course;  irritating  hacktivism, 
certainly;  but  cyber  war,  no,  at  least  not  by  a  careful 
definition.7  The  lack  of  evidence  of  cyber  performance 
of  several  kinds  in  warfare  has  contributed,  one  can 
assume,  to  the  immature  condition  of  the  strategic  un¬ 
derstanding  of  cyber  attested  to  in  the  epigraphs  to 
this  monograph. 

It  is  my  contention  that  we  do  know  enough  now, 
with  sufficient  confidence,  to  make  strategic  sense 
of  cyber.  But,  as  so  often  is  true  of  strategic  subjects, 
absent  contextualization  does  gratuitous  damage  to 
understanding.  Assuredly  we  do  not  have  available 
today  a  book  of  intellectual  merit  on  cyber  power 
equivalent  to  Brodie's  edited  work,  The  Absolute  Weap¬ 
on.8  But  it  so  happens  that  his  fairly  prescient  work  is 
conceptually  dominant,  far  more  with  the  inestimable 
value  of  hindsight,  than  was  evident  in  the  late-1940s. 
There  is  usually  a  theorist  or  two  who  gets  it  right  ear¬ 
ly  on,  even  before  "it"  appears  (though  not,  of  course, 
in  the  case  of  the  A-bomb).  But  that  fact,  verified  by 
historical  audit,  itself  can  mean  little  for  contemporary 
understanding,  let  alone  conduct.9  The  atomic  bomb 
had  been  "coming"  for  a  while,  but  its  practicability, 
demonstration,  and  use  in  1945  was  such  a  well-kept 
secret  that  there  was  extant  no  strategic  assessment  of 
its  meaning  beyond  the  most  obvious  and  immediate. 

Cyber  is  different  in  several  respects,  though  there 
are  also  some  similarities.  The  scientific  story  behind 
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the  atomic  bomb  had  a  provenance  of  the  better  part 
of  a  century  prior  to  1945,  that  of  our  contemporary 
IT  revolution  centered  around  the  computer  and  its 
exploitation,  is  easily  traceable  to  Alan  M.  Turing  in 
1936,  with  his  paper  "On  Computable  Numbers.  .  ."10 
However,  the  roots  of  21st-century  IT  can  be  identified 
very  plausibly  in  the  early-19th  century.  In  that  regard, 
it  is  probably  no  exaggeration  to  argue  that  the  elec¬ 
tric  telegraph  in  the  1840s,  leading  to  the  wiring  of  the 
world,  was  a  more  significant  technological  invention 
and  development  than  was  the  computer  in  the  late- 
20th  century.  Telegraph  wires,  the  atomic  bomb,  and 
the  computer  all  have  made  a  large  strategic  difference 
to  the  conduct  of  war  (and  peace).11  Whether  Brodie 
and  his  colleagues  at  Yale  were  somewhat  in  the  right 
about  the  atomic  bomb  in  1946,  serious  nuclear  debate 
about  the  strategic  meaning  of  the  technology  was  not 
concluded  until  the  mid-1960s.  Strategic  speculation 
by  scholars  pertinent  to  IT,  if  not  quite  to  cyber  ex¬ 
plicitly,  dates  only  from  the  early-1990s.  But  even  then 
the  conceptual  meeting  with  cyber  was  measured,  if 
not  tardy.  The  reason  may  well  have  been  that  cy¬ 
ber  was  somewhat  subsumed  strategically  in  public 
prominence  by  the  seductive  attractions  of  revolu¬ 
tions  in  military  affairs  (RMA),  transformation  and,  in 
the  2000s,  by  the  apparent  demands  of  the  "War  on 
Terror." 

It  appears  that  the  U.S.  defense  community  has 
difficulty  addressing  more  than  one  big  concept  (and 
believing  adjunct  elements)  at  a  time.  Cyber  power 
undoubtedly  was  present  at  the  table  of  U.S.  strategic 
thinking  and  defense  planning  from  the  1970s  until 
today.  Yet,  the  full-on  consideration  of  cyber  had  to 
wait  its  turn,  partly  pending  its  own  technical  ma¬ 
turity,  but  also  pending  official  and  public  exhaus- 
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tion  on  other  more  pressing  concerns  (e.g.,  RMA,  al- 
Qaeda,  et  al).  Today,  the  United  States  seems  bored 
with  al-Qaeda  and  recognizes  that  Iraq  and  Afghani¬ 
stan,  though  well-intentioned  projects,  were  not  suc¬ 
cesses.  At  this  time,  cyber  power  "catches  the  wave," 
as  one  might  put  it,  of  an  American  official  and  public 
mood  that  strongly  wishes  the  country  to  substitute 
stand-off  power,  kinetic  and  electronic,  for  boots  on 
the  local  ground  across  oceans.12  With  drones  and 
electrons,  the  American  public  favors  a  change  in  the 
strategic,  though  possibly  not  policy,  course  in  its  still 
continuing  commitment  to  police  selectively  what  has 
to  pass  for  a  tolerable  world  order.  Lest  I  be  misun¬ 
derstood,  this  monograph  is  not  about  U.S.  national 
security  policy.  The  intention  here  is  strictly  educa¬ 
tional  and  scholarly,  to  contribute  to  the  strategic  un¬ 
derstanding  of  cyber  power  — whatever  the  political 
purposes  to  which  that  power  is  committed. 

It  is  necessary  for  me  to  venture  briefly  and  with 
caution  into  highly  dangerous  terrain,  bearing  upon 
the  quantity  and  quality  of  the  strategic  literature  on 
cyber,  or,  more  accurately,  its  relative  shortage  —  rela¬ 
tive,  that  is,  to  cyber's  potential  strategic  importance. 
The  literature  is  also  historically  scarce,  when  com¬ 
pared  with  the  community  of  theorists  who  addressed, 
eventually  to  the  point  of  conceptual  exhaustion  by 
the  mid-1960s,  the  last  great  technology-driven  revo¬ 
lution— the  nuclear.  I  suggested  above  that  other  sub¬ 
jects  seemed  more  urgent  to  professional  strategists  in 
the  1980s,  1990s,  and  (most  of  the)  2000s.  However,  the 
current  state  of  the  strategic  understanding  of  cyber  — 
of  the  content  of  strategic  theory  for  cyber  —  seems  to 
this  strategist  to  be  notably  attributable  to  two  plau¬ 
sible  facts  unmentioned  thus  far. 

First,  I  suspect  that  many  strategists  with  only  a 
modest  technical  background  have  felt  themselves 
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somewhat  disenfranchised  from  cyber  commentary 
beyond  the  most  obvious.  The  sheer  "technicity"  of 
this  subject,  and  its  scientific  and  technological  dyna¬ 
mism  over  the  past  20  years,  have  discouraged  both 
critical  and  genuinely  strategic  assessment  of  the 
meaning  of  it  and  —  dare  it  be  said  —  may  have  dazzled 
unduly  those  who  were  intimidated  by  the  real  and 
apparent  wonders  of  cyber.  Generational  ebb  and 
flow  may  serve  to  explain  this,  but  strategic  think¬ 
ers  who  are  not  primarily  technical  in  their  expertise 
have  not  as  a  class  risen  to  the  strategic  challenge  of 
attempting  to  explain  cyber.  High-quality  strategic 
theory  about  cyber  simply  is  not  there  in  the  litera¬ 
ture  during  the  1990s  and  most  of  the  2000s.13  The 
negative  comparison  with  the  nuclear  debate  in  the 
1950s  is  almost  extraordinary  in  its  scale  and  quality; 
or,  at  least,  it  would  be,  were  the  challenge  posed  by 
cyber  to  be  judged  seriously  analogous  to  that  posed 
60  years  ago  by  nuclear  weapons.  As  I  argue  later  in 
this  monograph,  there  are  good  reasons  for  contem¬ 
porary  strategists  to  be  less  than  wildly  excited  about 
the  promise  and  perils  of  cyber  power,  but,  nonethe¬ 
less,  even  that  judgment  should  have  been  interesting 
enough  to  generate  a  larger  publishable  debate. 

Second,  for  a  reason  closely  related  to  the  first,  the 
acute  shortage  over  most  of  the  past  20  years  of  high- 
quality  strategic  literature  on  cyber  has  not  meant  that 
little  has  been  published  about  networked  computers. 
What  has  happened,  inevitably,  is  that  the  rapidly 
growing  cyber  library  has  been  filled  with  technical 
and  tactical  assessments.  To  risk  understatement, 
most  of  this  literature,  though  no  doubt  valuable  in 
its  own  right,  has  been  innocent  of,  or  naive  about, 
strategic  considerations.  This  claim  is  not  directed  as 
a  charge  against  those  who  wrote  largely  technically 
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and  sometimes  tactically  about  cyber  power  because 
that  is  what  they  knew.  Rather  it  is  a  charge  against 
those  of  us  strategists  who  did  not  rise  to  the  cyber 
challenge  in  a  timely  fashion  (mea  culpa!).  As  a  general 
comment  that  bears  on  the  missing  strategic  scholarly 
debate  about  cyber,  it  may  be  worth  noting  that  even 
strategists  who  are  not  themselves  highly  technically 
proficient  are  apt  to  be  unhealthily  attracted  to  the  ap¬ 
parent  promise  of  high  technology. 

The  plan  of  attack  now  moves  on  from  the  descrip¬ 
tion  of  the  conceptual  challenge,  to  the  explanation  of 
the  unity  in  strategic  theory  and  its  relevance  to  the 
cyber  domain.  Next,  the  analysis  considers  the  strate¬ 
gic  historical  experience  of  RMAs,  and  then  proceeds 
to  examine  the  strategic  promise  in  cyber  power.  The 
monograph  concludes  with  recommendations  for  use¬ 
ful  thought  and  action  about  cyber  power. 

CONTEXTS:  CYBER  IN  THE  FIVE  DOMAINS 
OF  WAR 

It  is  important  to  be  as  clear  as  possible  in  the  use 
of  key  organizing  concepts,  while  avoiding  academic 
pedantry  in  definition  and  explanation.  To  that  end, 
thus  far  I  have  spared  the  main  body  of  these  intro¬ 
ductory  pages  and  argument  definitions  of  the  con¬ 
cepts  most  important  to  this  analysis.  However,  the 
analysis  cannot  proceed  further  without  a  brief  pause 
for  definition  and  comment  on  terms.  Three  concepts 
dominate  the  leading  edge  of  cyber  debate  as  it  per¬ 
tains  to  the  mission  here:  cyberspace;  cyber  power; 
and  cyber  strategy.  I  select  two  definitions  of  cyber¬ 
space  and  suggest  that  these  should  be  regarded  as 
mutually  compatible,  though  the  first  one,  by  Daniel 
T.  Kuehl,  is  the  more  satisfactory: 
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Cyberspace  is  a  global  domain  within  the  information 
environment  whose  distinctive  and  unique  character 
is  framed  by  the  use  of  electronics  and  the  electromag¬ 
netic  spectrum  to  create,  store,  modify,  exchange,  and 
exploit  information  via  interdependent  and  intercon¬ 
nected  networks  using  information-communication 
technologies.14 

Additionally,  one  may  choose  to  agree  with  An¬ 
drew  F.  Krepinevich  in  understanding  that  cyberspace 
comprises  all  of  the  world's: 

computer  networks,  both  open  and  closed,  to  include 
the  computers  themselves,  the  transactional  net¬ 
works  that  send  data  regarding  financial  transactions, 
and  those  networks  comprising  control  systems  that 
enable  machines  to  interact  with  one  another.15 

For  cyber  power,  the  admirable  Daniel  T.  Kuehl 
advises  that: 

[CJyberpower  ...  is  the  ability  to  use  cyberspace  to 
create  advantages  and  influence  events  in  all  the 
operational  environments  and  across  the  instruments 
of  power.16 

My  prefered  definition  of  cyber  power  is  an  adap¬ 
tation  of  my  preferred  definition  of  air  power,  which 
I  borrowed  gratefully  from  General  William  "Billy" 
Mitchell.  He  was  admirably  nonspecific,  robust,  inclu¬ 
sive,  and  yet  clear.  Adapted  to  fit  the  fifth  geographical 
domain,  my  definition  holds  that  cyber  power  is  the 
ability  to  do  something  strategically  useful  in  cyber¬ 
space.17  This  wording  more  than  compensates  in  clar¬ 
ity  of  meaning  for  what  it  lacks  in  literary  elegance, 
and  the  ambiguity  is  both  deliberate  and  useful. 
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The  third  vital  concept  that  should  be  written  and 
thought  about  is  strategy  for  cyber,  not  cyber  strategy. 
Kuehl  employs  the  latter  wording,  which  inadvertent¬ 
ly  encourages  misunderstanding.  Strategy  is  strategy, 
whether  it  is  for  cyber  power,  Landpower,  sea  power, 
or  whatever.  To  conceive  of  cyber  strategy  risks  giving 
the  appearance  of  licensing  the  view  that  cyber  is  the 
dominant  partner  over  strategy.  Strategy  for  cyber  is 
syntactically  useful,  because  it  should  reduce  the  risk 
that  people  will  believe  that  the  strategy  can  be  intel¬ 
lectually  as  distinctive  as  cyberspace  is  unique. 

The  concepts  of  cyber  war  and  cyber  warfare  men¬ 
tioned  briefly  earlier  are  more  heavily  laden  with  polit¬ 
ical,  legal,  and  moral  issues  than  are  cyberspace,  cyber 
power,  and  strategy  for  cyber.  The  dispute  about  the 
exact  meaning  of  these  three  big  ideas  can  fuel  much 
heat  as  well  as  light,  but  it  lacks  obvious  powder  trails 
to  dangerous  real-world  consequences.  This  is  not  the 
case  with  reference  to  cyber  war  and  cyber  warfare. 
There  can  be  seriously  harmful  consequences  to  defin¬ 
ing  some  cyber  activity  as  warfare  and  possibly  war. 
All  political  communities  understand  themselves  to 
be  in  different  political,  legal,  and  moral  terrain  when 
they  are  in  a  condition  of  war  and  are  conducting,  cer¬ 
tainly  are  in  receipt  of,  acts  of  warfare  — as  contrasted 
with  a  condition  of  nonwar.  In  other  words,  whereas 
cyberspace,  cyber  power,  and  strategy  for  cyber  es¬ 
sentially  are  concepts  most  fit  for  technical  defini¬ 
tion,  cyber  war  and  warfare  are  subjects  for  judgment 
and  choice. 

Much  as  it  is  necessary  to  locate  the  Cold  War  in 
the  whole  stream  of  strategic  history,  notwithstand¬ 
ing  the  novelty  and  awesomeness  of  the  nuclear  fact, 
so  likewise  the  Information  Age,  the  IT  revolution,  or 
cyber  (pick  a  preferred  label)  require  conceptual  and 
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historical  contextualization.  Whereas  technically  fo¬ 
cused  strategists  once  wrote  as  if  their  strategic  world 
bore  little  if  any  relation  to  the  whole  course  of  history 
prior  to  July  1945,  so  it  is  that  in  their  turn  many  of  our 
contemporary  cybernauts  can  scarcely  imagine  strate¬ 
gic  and  other  life  before  the  arrival  of  the  electronic 
computer.  I  exaggerate,  but  not  by  much.  Indeed,  in 
the  1970s,  I  wrote  an  article  critical  of  those  whose  cog¬ 
nitive  realm  of  historical  relevance  began  unarguably 
only  in  1945,  and  possibly  in  1952,  with  the  testing  of 
thermonuclear  weapons.18  The  full  meaning  of  a  new 
technology  cannot  be  grasped  solely  on  its  own  scien¬ 
tific  and  technical  terms,  essential  though  that  is.  New 
technologies  have  life  cycles,  and  they  may  have  story 
arcs  — to  borrow  from  Hollywood— within  yet  greater 
life  cycles  and  story  arcs  that  probably  have  no  end 
point  reachable  soon  by  purposeful  human  endeavor. 

Technologies  such  as  nuclear  weapons  and  com¬ 
puters  exist  in  context,  and  their  contexts  in  turn  also 
have  context.  When  we  marry  the  potent  idea  of  con¬ 
text  to  the  persistent  reality  of  useful  analogy,  we  have 
at  least  the  beginnings  of  the  historical  and  conceptual 
forensic  toolkit  necessary  to  make  strategic  sense  of 
cyber.  This  is  not  to  deny  that  context  can  be  an  overly 
demanding  conceptual  tool,  because,  as  Dr.  Antulio 
Echevarria  has  insisted  correctly,  it  does  not  have 
natural  frontiers.19  There  is  always  context  to  context, 
without  logical  end:  it  helps  explain  everything,  but  in 
such  a  way  that  it  can  thwart  explanation.  However, 
it  is  necessary  to  approach  cyberspace,  cyber  power, 
and  strategy  for  cyber  in  their  historical  and  other  con¬ 
texts,  and,  in  doing  so,  it  is  also  necessary  to  be  open  to 
what  we  might  learn  by  analogy. 

On  the  evidence  of  their  writings,  most  of  the  people 
who  write  expertly  about  the  dynamic  cyber  frontier 
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know  little  strategic  history  and  have  few  credentials 
in  strategic  theory.  As  always,  there  are  exceptions, 
and  I  do  not  intend  these  remarks  as  criticism  of  our 
cybernauts.  There  is  no  reason  why  excellence  in  tech¬ 
nical  understanding  of  the  digital  revolution  should 
equip  a  person  with  strategic  sense  about  the  net  ca¬ 
pabilities  of  his  or  her  machines.  But,  it  is  an  enduring 
reality  that  politics  abhor  a  vacuum,  meaning  that  the 
absence  of  strategic  expertise  among  cyber  inventors, 
developers,  and  heavy  users  will  not  remain  a  void 
for  long.  When  those  educated  in  (grand  and  military) 
strategy  are  not  on  the  job,  those  who  are  strategically 
uneducated  soon  will  be;  at  least  they  will  be  on  the 
job  as  they  understand  it,  very  largely  in  the  techni¬ 
cal  and  tactical  terms  that  construct  their  comfort  zone 
of  expertise. 

Our  journey  toward  a  better  strategic  understand¬ 
ing  of  cyber  can  begin  with  the  recognition  of  three 
vital  contexts:  the  theory  (meaning  the  general  theory) 
of  strategy,  geography  (meaning  the  distinctive  geo¬ 
graphical  domains),  and  information. 

Context  1:  Strategy's  General  Theory. 

First  and  foremost,  it  is  necessary  to  register  the 
fact  that  cyber  in  all  its  technological,  psychological, 
political,  military,  and  other  aspects  is  under  the  in¬ 
tellectual  authority  of  strategy's  general  theory.  Given 
that  we  seem  to  have  made  enough  strategic  sense  of 
nuclear  weapons  thus  far,  though  admittedly  with  ca¬ 
veats  and  many  prayers,  cyber  power  presents  little 
difficulty.  With  a  sole  exception  that  is  not  likely  to  be  a 
game  changer  for  human  conflict,  cyber  power  should 
be  understood  as  just  another  category  of  weapon  (and 
a  weapon  should  be  understood  to  be  anything  that 
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is  used  for  the  purpose  of  causing  harm).20  As  such  a 
category,  cyber  undeniably  is  far  more  pervasive  and 
intrusive  than  are  other  environmentally  classifiable 
types  of  weapon,  but  that  granted,  in  tactical  applica¬ 
tion  it  is  a  tool  of  policy  and  strategy  in  common  with 
Landpower,  sea  power,  air  power,  and  space  power. 
Such  geographical  categories  are  seriously  challenged 
by  the  increasingly  joint  and  even  integrated  character 
of  contemporary  military  operations,  but  such  poros¬ 
ity  does  not  render  irrelevant,  nor  can  it  invalidate,  the 
importance  of  the  distinctiveness  of  the  five  geogra¬ 
phies  (domains)  of  war. 

Regardless  of  its  geographical  affiliation,  all  weap¬ 
onry  and  strategic  endeavor  are  under  the  authority 
of  a  unified  general  theory  strategy.  The  attached  ap¬ 
pendix  is  my  version  of  that  theory,  presented  in  the 
summary  form  of  "22  Dicta."21  Of  the  22  Dicta,  only 
one  appears  to  be  lethally  contradicted  by  cyber.  Spe¬ 
cifically,  Dictum  2  defines  military  strategy  as  "the  di¬ 
rection  and  use  made  of  force  and  the  threat  of  force 
for  the  purposes  of  policy  as  decided  by  politics." 
This  Clausewitzian  definition  may  seem  incompatible 
with,  or  at  least  very  uncomfortable  with,  a  cyber  pow¬ 
er  that  can  neither  kill  people  directly  nor,  as  a  general 
rule,  wreak  physical  damage.  These  realities  of  elec¬ 
tronic  "warfare"  should  not  be  permitted  to  paralyze 
strategic  sense.  Hostile  behavior  in  cyberspace  and  the 
potential  of  cyber  action  to  assist  in  joint  warfare  that 
includes  lethal  physical  contact  render  cyber  a  cate¬ 
gory  of  weapon,  albeit  one  that  distinctively  does  not, 
indeed  cannot,  itself  apply  force.22  Cyber  warfare  is 
not,  however,  entirely  unprecedented  in  its  potential 
to  do  harm  to  people  without  applying  force  directly. 

For  example,  economic  warfare  in  the  two  World 
Wars  was  confined  not  only  to  the  infliction  of  harm 
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kinetically,  but  also  by  the  manipulation  of  commod¬ 
ity  and  other  markets  in  neutral  countries,  in  order 
to  starve  belligerent  populations  and  deprive  their 
industries  of  necessary  raw  materials.  Cyber  is  an  ex¬ 
treme  case  of  nonkinetic  agency,  but  the  legal  prob¬ 
lems  (in  the  laws  of  war)  created  by  regarding  combat 
electrons  effectively  as  equivalents  to  agents  of  force 
ought  to  be  overwhelmed  by  strategic  sense.  Cyber 
plainly  is  different  from  Landpower  in  the  way  it  can 
work,  but  nonetheless  it  is  obviously  a  weapon.  Hos¬ 
tile  intent,  motivation,  rules  this  judgment,  not  careful 
analysis  of  the  nature  of  the  electronic  agents  aimed  to 
do  harm. 

With  the  sole  exception  just  discussed,  which  pos¬ 
es  only  superficial  difficulty,  there  is  nothing  in  the 
general  theory  of  strategy  that  does  not  apply  vitally 
to  cyber.  The  obvious  fact  that  cyberspace  is  geophysi¬ 
cally  different  from  the  other  environments  is  close  to 
banal.  The  function  of  this  general  theory  is  to  explain 
the  nature  and  key  working  of  the  subject.  The  general 
theory's  value  for  us  now  includes  its  high  merit  in 
allowing  us  to  de-particularize  cyber,  or,  indeed,  any 
other  environmentally  specific  category  of  (military) 
power.  The  general  theory  provides  the  essentials  of 
a  common  language  for  cognition  that  rules  over  any 
and  all  kinds  of  strategic  projects,  regardless  of  their 
specific  character  and  purpose.  The  theory  of  strategy 
says,  silently  but  unmistakably  by  inclusive  mean¬ 
ing,  that  cyber  is  just  another  rather  fuzzy  category 
of  power.  While  every  technical  and  tactical  detail 
important  to  the  generation  and  every  intended  use 
of  cyberspace  requires  close  attention  in  detail,  rec¬ 
ognition  of  the  general  theory's  sway  permits  cyber- 
nauts  to  see  themselves  and  their  special  duties  in  the 
appropriate  strategic  context.  Cybernauts  are  doing 
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strategy,  meaning  that  they  are  employing  cyber  ulti¬ 
mately  for  the  same  higher  ends  of  political  advantage 
as  our  military  tools,  which  make  physical  contact 
with  the  enemy.  For  morale,  as  well  as  for  reasons  of 
necessary  tactical  and  technical  expertise,  it  is  impor¬ 
tant  for  troops  to  be  proud  of  their  "  specialness ."  But 
such  pride  needs  to  be  guided  by  the  strategic  sense 
that  the  general  theory  of  strategy  insists  should  suf¬ 
fuse  all  of  a  community's  belligerent  efforts,  no  matter 
how  one's  own  portion  of  that  project  is  understood 
tactically  and  technically.  The  general  theory  helps 
to  contextualize  cyber  crucially  and  properly,  not  to 
demote  it. 

Context  2:  Geography. 

It  is  convenient  to  regard  cyberspace,  which  should 
really  be  cyberspaces,  as  a  fifth  geographical  domain 
for  war,  peace,  defense  preparation,  and  strategy.  It 
is  somewhat  counterintuitive  to  attempt  to  think  of 
cyberspace  in  geographical  terms,  given  its  essential 
placelessness.23  It  is  more  appropriate  to  consider 
cyberspace  as  comprising  any  number  of  networked 
(and  perhaps  networkable)  spaces  that  people  choose 
to  construct.  Although  the  proposition  that  cyber¬ 
space  is  simply  one  of  five  geographical  domains  is 
expedient,  there  are  perils  in  the  geographical  claim. 
I  have  said  here  only  that  approaching  cyberspace  as 
a  fifth  geography  for  strategic  attention  is  convenient 
and  expedient;  I  have  not  asserted  that  it  is  either  sci¬ 
entifically  or  social-scientifically  right  to  do  so.  The 
preferred  characterization  of  cyberspace  remains  a 
cognitive  work  still  in  progress. 

There  is  some  danger  in  the  expedient  categoriza¬ 
tion  of  cyberspace  as  a  geographically  nameable  op- 
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erational  domain.  In  particular,  we  are  nearly  certain 
to  be  seduced  by  the  familiarity  of  geographical  iden¬ 
tification  into  making  inappropriate  analogies  from 
other  operational  domains  with  their  own  unique  ge¬ 
ographies.  The  absence  of  meaningful  physicality  in 
cyberspace  and  cyber  power  amounts  to  an  uncom¬ 
fortable  intangibility.  This  ethereality  is  sufficiently 
alien,  even  intellectually,  to  kinetic  thinkers,  for  them 
to  be  motivated  to  attempt  to  translate  cyber  into  terms 
more  friendly  to  their  military  culture  than  it  is  or  can 
be.  Familiarity  will  be  identified,  whether  or  not  it  is 
present  or  could  be  created  by  digitally  expressed  hu¬ 
man  will. 

It  has  long  been  a  feature  of  strategic  history  that 
people  respond  to  new  challenges  largely  on  the  basis 
of  what  they  understand  strategically  about  answers 
to  old  challenges.  To  risk  anticipating  later  argument 
unduly,  there  is  extraordinary  peril  in  theorizing  by 
analogy  when  the  subject  of  contemporary  concern 
(cyber)  has  either  no,  or  only  distinctly  challengeable, 
history  in  strictly  defined  warfare.  Moreover,  the  RMA 
theory  that  seeks  to  explain  episodic  important  chang¬ 
es  in  the  character  of  warfare  is  itself  none  too  reliable. 
When  debating  the  strategic  meaning  of  cyber,  it  is 
important  for  our  necessary  intellectual  humility  that 
we  recognize  that,  in  effect,  we  are  working  with  two 
"maybes"  and  trying  to  construct  a  positive  story  on 
shaky  foundations.  This  is  not  necessarily  to  be  highly 
critical  of  RMA  theory  or  of  current  judgments  about 
what  is  or  may  be  evidence  of  cyber  warfare.  Howev¬ 
er,  I  would  like  to  remind  people  that  bold  and  attrac¬ 
tive  explanations  of  allegedly  great  strategic  historical 
changes  really  are  only  theories.  RMA  theory,  for  the 
case  in  point,  is  a  family  of  intellectual  constructions 
by  scholars  put  upon  complex  processes  that  usually 
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can  bear  more  than  one  dominant  narrative  of  causes 
and  claimed  effects. 

The  discussion  above  seeks  to  register  as  strategi¬ 
cally  important  the  claims  that:  although  cyberspace 
is  radically  different  geophysically  from  the  land, 
sea,  air  and  Earth-orbital  environments,  it  is  still  very 
much  a  geographical  context  as  the  others.24  There  is 
physical  geography  to  cyberspace,  comprising  user 
people,  dedicated  machinery,  and  the  interactive 
consequences  of  cyber  in  joint  and  integrated  action 
on  extra-cyber  geographies.  Much  as  we  can  find  it 
difficult  to  allow  historical  education  sufficient,  but 
not  overmuch,  weight  in  our  strategic  learning,  so  it 
is  not  always  easy  to  be  both  properly  respectful  of 
what  is  unique  about  cyberspace,  but  not  accord  that 
uniqueness  a  strategic  significance  it  may  not  merit. 
Contextual  examination  cannot  lift  the  peril  of  under¬ 
appreciation  or  overappreciation  of  change  —  techni¬ 
cal  change  in  this  case  — but  it  should  serve  to  reduce 
the  danger  of  such. 

It  may  be  unduly  hazardous  to  say  this,  but  it  is 
most  prudent  to  regard  cyber  as  just  another  geo¬ 
graphical  domain  (for  politics,  conflict,  and  strategy), 
but  one  that  is  unique.  Admittedly,  the  nonphysical- 
ity  of  cyber  is  a  domainal  singularity,  but  one  should 
hesitate  before  being  overimpressed  by  the  strategic 
meaning  of  this  geophysical  fact  of  intangibility.  We 
have  always  thought,  theorized,  moralized,  and  leg¬ 
islated  about  armed  force  — an  historical  reality  that 
helps  explain  the  strategic  strangeness  of  the  electro¬ 
magnetic  spectrum  (EMS)  in  its  cyber  manifestations. 
Obviously,  the  EMS  and  its  cyberspace(s)  that  we  con¬ 
struct  pose  an  unusual  challenge  to  strategic  thought 
and  practice.  But  the  domainal  assignment  that  today 
finds  favor,  albeit  not  unarguably,  is  right  enough,  if  to 
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a  degree  over-simple.  Theory,  which  is  to  say,  expla¬ 
nation,  of  cyber  as  a  geography  of  conflict,  including 
warfare,  may  be  rather  rough,  but  it  is  ready  enough 
to  serve  the  practical  purposes  of  strategic  conceptual¬ 
ization  for  good-enough  strategic  practice. 

Context  3:  Information. 

Concepts  and  the  words  chosen  to  express  them 
have  histories  and,  as  cultural  artifacts,  they  are  apt 
to  have  unsteady  life  stories  as  circumstances  and 
fashions  change.  Thus  far,  I  have  claimed  that  there 
is  value  in  contextualizing  cyber  both  intellectually  — 
as  yet  another  subfield  over  which  the  general  theory 
of  strategy  must  enjoy  authority  —  and  also  as  but  the 
latest  distinctive  environmental  domain  for  strategy. 
The  third  contextual  perspective  that  can  help  us  un¬ 
derstand  the  EMS  and  our  constructed  cyber  realm(s) 
is  that  of  information.  Information  enjoyed  great 
popularity  as  an  organizing  idea  in  the  1990s,  before 
closer  study  and  much  experience  of  its  use  and  mis¬ 
use  revealed  that  it  was  so  close  to  being  conceptually 
boundary-free  that  it  lacked  forensic  value.  This  con¬ 
ceptual  demotion  from  the  premier  league  of  concepts 
believed  to  carry  the  seeds  of  strategic  decisiveness,  or 
some  such  elevated  aspiration,  was  well  enough  de¬ 
served,  but  it  came  at  a  cost  that  was  unfortunate  for 
the  understanding  of  cyber  that  we  need. 

What  is  strategically  new  and  very  different  — at 
best,  unfamiliar  —  about  cyber  is  now  fairly  obvious, 
but  what  is  not  so  obvious  is  just  what  this  techni¬ 
cal  novelty  means  strategically.  There  is  a  nontrivial 
danger  that  our  contemporary  anxiety  about,  even 
fear  of,  cyber  power  and  cyber  warfare  will  promote 
and  consolidate  a  body  of  alleged  Great  Truths  that 
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will  be  nothing  of  the  kind.  One  way  in  which  we  can 
help  understand  what  cyber  is  about,  what  it  means, 
and  what  its  historical  trajectory  as  a  toolkit  may  be, 
is  to  contextualize  it  functionally.  To  do  so  is  not  to 
demean  or  demote  cyber,  but  it  is  to  remind  ourselves 
that  we  do  have  more  or  less  accessible  the  political 
or  strategic  history  of  our  species  over  the  past  2  1/2 
millennia  —  and,  functionally  regarded,  cyber  has  se¬ 
rious  provenance,  there  is  a  longue  duree  of  relevant 
context.  To  state  the  blindingly  obvious,  cyber  is  in¬ 
formation  and  the  communication  of  this  information 
for  all  manner  of  strategic  purposes.25  It  takes  scarcely 
a  moment's  reflection  to  recognize  the  familiarity  of 
these  concepts.  Assuredly,  cyber  is  technically  ex¬ 
traordinary,  but  so  too  was  the  electric  telegraph  in 
the  1840s.  The  telephone,  radio,  and  television  were 
each  on  the  frontier  of  technological  achievement  for 
a  short  while.  In  the  1920s  and  1930s,  notwithstanding 
its  introductory  experience  in  belligerent  action  from 
1914  to  1918,  motorization  and  mechanization  was  a 
cumulatively  startling  strategic  reality.  It  bore  a  some¬ 
what  uncertain,  though  assuredly  awe-inspiring  and 
potentially  awful,  strategic  narrative.  Rival  theories 
contended  for  public  attention,  official  endorsement, 
and  funding  in  defense  planning.26 

Whatever  else  cyber  power  may  be,  for  certain  it 
is  information  and  its  communication.  Cyber  power 
has  to  be  expressed  as,  in,  and  through  networks  with 
physical  architecture.27  It  is  no  great  challenge  to  rec¬ 
ognize  the  historical  longevity  of  much  of  the  cyber 
function.  Without  for  one  moment  ceasing  to  be  deep¬ 
ly  impressed  by  cyber's  novel  features  —  speed  and  po¬ 
tential  ubiquity,  for  example  —  it  would  be  helpful  to 
place  cyberspace  and  cyber  power  in  strategic  histori¬ 
cal  perspective.  If  cyber  is  quintessential^  about  the 
communication  of  information,  leaving  aside  for  now 
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the  particulars  that  that  wording  conceals,  it  ought  to 
be  reasonable  to  argue  that  cyber  is  only  the  latest  of 
mankind's  efforts  to  facilitate  the  information  (and  its 
communication)  function.  Information  in  its  many  hu¬ 
man  and  technical  aspects  has  historical  form  shaped 
significantly  in  its  characteristics  by  enduring  factors. 
It  follows  that  we  should  be  able  to  learn  much  from 
historical  experience  about  the  benefits  and  costs  and 
perhaps,  but  only  perhaps,  the  course  frequently  tak¬ 
en  by  technical  change,  which  can  be  disconcertingly 
rapid.  However,  it  is  helpful  to  our  understanding  to 
strip  away  the  toolkit  of  the  period,  any  period,  that 
handles  the  communication  of  information,  and  grasp 
as  firmly  as  one  can  that  the  technical  excitement  of 
the  moment  really  relates  only  to  the  enabling  tools. 
Cyber  power  is  not  about  computers  and  their  net¬ 
works;  rather,  it  is  about  what  networked  computers 
are  able  to  do  in  passing  on  information  and  what  the 
consequences  might  be. 

It  should  be  recalled  that  the  strategist's  most  vital 
question  is  always  "So  what?"  The  answer  to  that  ques¬ 
tion  is  what  the  strategist  needs  to  understand  about 
the  technically  wonderful,  if  frustratingly  somewhat 
intangible,  world  of  cyber.  Cyber  will  do  what  strate¬ 
gists  want  done  faster,  over  longer  range,  and  perhaps 
far  more  stealthily,  than  ever  before.  But  functionally 
regarded,  cyber  fits  unexceptionally  into  the  course  of 
strategic  history.  The  technology  certainly  changes, 
but  the  general  theory  of  strategy  is  not  interested  in 
that  incontestable  fact.  If  cyber  is  only  the  latest  way 
to  perform  familiar  tasks,  what  does  that  imply  for  its 
strategic  significance?  Also,  is  it  possible  that  cyber 
power  is  or  will  be  so  different  from  other  kinds  of 
power  that  it  cannot  prudently  be  regarded  and  treat¬ 
ed  simply  as  a  team  player  in  the  ever-evolving  joint 
and  possibly  integrated  narrative  of  warfare? 
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RMA  Theory  and  Cyber. 

It  is  commonplace  to  regard  modern  IT  as  having 
sponsored,  triggered,  and  enabled  strategic  changes 
worth  labeling  as  revolutionary.  Today,  it  is  believed 
an  IT-enabled  RMA  either  has  occurred  or  plainly  is 
occurring  in  real  time.  This  is  not  usually  understood 
to  be  an  assumption,  but  rather  is  accepted  in  the  cat¬ 
egory  of  verified  facts.28  Without  necessarily  challeng¬ 
ing  the  claim  that  an  IT-led  RMA  is  well  under  way 
in  strategic  affairs,  it  is  appropriate  to  set  strategic 
thought  about  cyber  in  some  historical  context  viewed 
with  a  healthy  skepticism.  The  issue  of  high  moment 
here  is  not  the  reality  of  cyberspace  and  its  dynamic 
technical  improvement,  but  rather  the  strategic  sig¬ 
nificance  of  these  electronic  and  physical  actualities. 
When  viewed  by  a  strategist  thinking  strategically, 
cyberspace  and  cyber  power  invite,  indeed,  demand, 
plausible  answer(s)  to  the  fundamental  question, 
"So  what?" 

Cyber  thought  and  directly  relevant  behavior  is 
easily  traceable  to  the  mid-1980s,  while  its  subsequent 
amble,  canter,  and  then  gallop  to  today  has  been  tech¬ 
nically  so  glittering  that  its  conceptual  understanding 
for  strategy  has  been  neglected,  or  perhaps,  more  deli¬ 
cately  expressed,  postponed.29  Because  the  technology 
that  enables  cyber  has  been  technically  so  successful, 
few  people  with  skills  in  strategic  reasoning  have  felt 
moved  to  provide  strategic  explanation  of  the  obvi¬ 
ously  burgeoning  IT  revolution  carried  by  the  elec¬ 
tronic  computer.  The  situation  today  is  that  cyber  — 
networked  computers  —  has  advanced  technically  and 
tactically  at  high  speed,  as  has  compliant  policy  and 
its  politics,  to  the  limited  degree  to  which  they  have 
been  required  to  provide  a  site  license.  But,  not  for  the 
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first  time  in  modern  history,  strategy  has  largely  been 
absent.  In  other  words,  networked  computers  have 
been  blessed  politically,  and  there  has  been  a  rush  to 
adopt  and  exploit  them  as  best  as  we  have  been  able 
while  the  technology  has  been  moving  on  us  rapid¬ 
ly.  Missing  from  the  ever-more-highly  paced  action, 
which  is  to  say,  from  the  technical  adoption  and  the 
practical  doing,  has  been  a  serious  endeavor  to  under¬ 
stand  what  it  all  means  strategically. 

Lest  I  should  be  accused  of  exaggeration,  I  can 
cite  in  my  support  recent  parallel  judgments  by  other 
analysts.  The  first  two  epigraphs  above  both  point 
explicitly  to  the  contemporary  immaturity  of  strate¬ 
gic  thought  about  cyber,  while  in  his  examination  of 
cyber  perils  for  evidence  of  a  nuclear  option,  Krepin- 
evich  contrasts  early  thought  about  atomic  weapons 
with  the  paucity  of  thought  on  cyber  over  the  past  15 
years.30  There  is  no  shortage  of  candidates  to  blame  for 
the  strategic  poverty  in  the  cyber  literature,  but  there 
is  possibly  an  imperial  one  that  has  escaped  much 
notice.  Because  this  particular  contributor  to  the  sup¬ 
pression  of  strategic  thought  has  not  attracted  atten¬ 
tion  and  continues  to  have  influence,  it  needs  to  be 
aired  and  assayed.  The  arguable  villain  is  RMA  theo¬ 
ry,  considered  in  the  context  of  a  defense  community 
not  overly  skilled  in  strategic  thought  or  practice. 

Scientific  excitement,  technological  novelty,  and 
the  uncertainty  that  must  attend  innovation,  business 
opportunism,  and  the  political  and  bureaucratic  ad¬ 
vantages  that  are  apt  to  reward  genuine  enthusiasm, 
formed  a  heady  brew  difficult  to  imbibe  prudently.  In¬ 
deed,  there  seemed  to  be  a  sense  almost  of  surrender 
to  an  untamed  and,  for  a  while,  untamable  technical 
change,  following  which— to  hypothesize  rather  bold¬ 
ly— a  time  would  come  for  mature  reflection.  There 
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has  been  a  sense  in  which  defense  communities,  led 
by  the  United  States  thus  far,  have  all  but  surrendered 
to  science  and  technology,  possibly  safe  enough  in  the 
historically  well-founded  belief  that  "one  day,"  we, 
or  someone,  will  sort  out  what  all  this  computer-led 
change  means  strategically.  Contrary  to  appearances, 
this  attitude  of  somewhat  strategically  uncompre¬ 
hending  acceptance  of  scientific  and  technical  change 
often  is  as  realistically  necessary  as  it  proves  actually 
to  be  safe  enough. 

The  consequences  of  great  scientific  and  technical 
changes  are  rarely  predictable.  Even  when  hindsight 
allows  us  to  identify  the  prophets  who  were  mainly 
correct,  it  is  unusual  for  our  honor  roll  to  correlate 
closely  with  those  who  were  most  respected  at  the 
time.  Railroads,  radio,  aircraft,  television,  nuclear 
weapons,  and  now  electronic  computers  did  not  exact¬ 
ly  appear  fully  and  strategically  comprehended  when 
first  they  appeared.  Moreover,  even  nuclear  weapons 
experienced  a  decade  and  more  of  consideration,  as 
well  as  technological  change,  before  a  theory  adequate 
to  explain  them  strategically  took  firm  shape.  Serious 
policy  and  strategy  debate  about  nuclear  weapons  was 
not  concluded  until  1966.  This  means  that  those  who 
seek  to  compare  and  contrast  unfavorably  the  history 
of  strategic  thought  on  cyber  with  the  early  years  of 
nuclear  thought  can  be  on  shaky  ground  historically. 

Krepinevich  may  mislead  when  he  offers  the  fol¬ 
lowing  historical  comparison: 

Yet,  despite  its  enormous  potential  consequences  for 
the  security  and  well  being  of  the  world's  leading  eco¬ 
nomic  powers,  the  issue  of  catastrophic  cyber  attacks 
is  only  now  emerging,  even  though  we  are  perhaps 
15  years  or  more  into  the  era  of  cyber  weapons  and 
warfare.  This  stands  in  striking  contrast  to  the  concen- 
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trated  and  persistent  efforts  of  many  of  the  world's 
best  strategic  thinkers  to  understand  the  implications 
of  nuclear  weapons  in  the  decades  immediately  fol¬ 
lowing  their  introduction  in  1945. 31 

The  fact  is  that  the  world's  best  strategic  thinkers 
did  not  engage  impressively  in  a  debate  over  nuclear 
weapons  until  the  H-bomb  arrived  after  1952  and  the 
Dwight  Eisenhower  administration  endeavored  to 
make  strategic  sense  of  its  nuclear  inheritance.  In  an 
outstanding  intellectual  history  of  American  thought 
about  nuclear  strategy  in  the  early  years  of  the  Cold 
War,  Marc  Trachtenberg  has  shown  convincingly 
and  unsurprisingly  that  much  was  misunderstood 
by  Brodie  in  1946,  and  that  the  most  creative  period 
of  American  strategic  thought— at  least  in  its  nuclear 
dimension— can  be  dated  most  convincingly  to  the 
period  1955-66.  Argument  today  claiming  fairly  plau¬ 
sibly  that  cyber  has  yet  to  benefit  from  profound  stra¬ 
tegic  thought  is  not  much  aided  by  unsound  reference 
to  the  late-1940s  and  early-1950s.32  The  debate  over 
nuclear  strategy  had  not  been  over-impressive  when 
the  weaponry  was  only  of  a  fissionable  nature,  but  it 
flared  into  active  life  with  the  arrival  of  fusion  weap¬ 
ons.  The  decade  1955-66  can  be  called  the  "golden  era" 
of  American  strategic  thought.33  By  the  mid-1960s,  the 
subject  of  nuclear  strategy  was  intellectually  exhaust¬ 
ed.  If  Krepinevich's  analogy  is  taken  seriously,  today 
we  are  in  1960  on  the  nuclear  timeline,  and,  indeed, 
cyber  is  lagging  by  nuclear  comparison.  However,  it 
is  a  mistake  to  regard  the  late-1940s  and  early-1950s  as 
a  period  of  lively  and  bold  strategic  theorizing  about 
things  nuclear.  Among  other  caveats,  we  need  to  be 
attentive  to  the  huge  difference  in  the  strategic  context 
affected  by  the  arrival  of  the  H-bomb. 
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The  need  for  strategic  common  sense  about  cyber 
is  pressing,  notwithstanding  the  difficulties  that  im¬ 
pede  its  provision.  Politicians  and  civil  servants  un¬ 
wisely  are  addicted  to  the  concept  of  a  "foreseeable 
future,"  which  is,  alas,  substantially  fictitious  as  it  is 
typically  casually  employed.  However,  the  future  can 
be  foreseen  in  the  sense  of  anticipated,  even  though 
it  cannot  be  predicted  in  detail.  The  practical  chal¬ 
lenge  is  to  understand  how  best  to  use  what  we  think 
we  know  with  high  reliability  about  the  future  of  cy¬ 
ber  in  its  strategic  meaning.  Strange  as  it  may  seem 
to  some,  and  poverty-stricken  though  we  have  to  be 
about  the  detail  of  cyber's  future  scientific  and  tech¬ 
nical  course,  we  are  reasonably  well  supplied  with 
theory  to  explain  by  our  variable  access  to  millennia  of 
strategic  history. 

Strange  though  it  may  appear  to  many  of  those 
who  are  busy  technically  developing,  doing,  and  mak¬ 
ing  use  of  cyber,  there  is  to  hand  (perhaps  to  brain) 
useful  strategic  theory  that  can  aid  understanding. 
The  advice  in  the  general  theory  of  strategy  cannot 
educate  about  technical  detail  and  tactical  doing, 
but  assuredly,  it  contextualizes  the  technology  and 
tactics  of  cyber.  In  so  doing,  it  carries  plain  implica¬ 
tions  for  the  likely  character  of  this  latest  wave  in 
strategic  history. 

RMA  theory  strives  to  make  strategic  sense  of  the 
past  7  centuries,  and  in  the  main,  it  has  shed  useful 
light.  But  what  is  an  RMA,  and  how  can  we  distin¬ 
guish  it  from  antecedent  and  succeeding  phenom¬ 
ena?  The  most  widely  used  definition  was  coined 
by  Krepinevich  and  deployed  to  lasting  effect  in  an 
article  published  in  1994. 

What  is  a  military  revolution?  It  is  what  occurs  when 

the  application  of  new  technologies  into  a  significant 
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number  of  concepts  and  organizational  adaptation  in 
a  way  that  fundamentally  alters  the  character  and  con¬ 
duct  of  conflict.  It  does  so  by  producing  a  dramatic 
increase  —  often  an  order  of  magnitude  or  greater  — 
in  the  combat  potential  and  military  effectiveness  of 
armed  forces. 34 

This  popular  and  influential  definition  appeared 
sophisticated  in  its  inclusivity  (i.e.,  "concepts  and  orga¬ 
nizational  adaptation,"  not  only  "new  technologies"), 
but  it  was  essentially  tactical  in  focus— just  possibly 
operational,  but  not  strategic  or  political.  This  tactical 
perspective  on  military  change  was  limited  in  its  utility 
by  limitations  more  than  marginally  obscured  by  the 
fact  that  it  was  presented  as  the  ambitious  conceptual 
key  to  a  sweeping  explanation  of  historical  change.  Of 
importance  for  this  analysis  is  not  so  much  the  chal¬ 
lengeable  historical  merit  of  RMA  theory,  but  rather 
the  consequences  of  that  theory  for  the  understand¬ 
ing  of  cyber.  The  American  defense  community  that 
woke  up  in  the  later-2000s  to  its  need  to  make  some 
strategic  sense  of  its  relatively  unfamiliar  cyber  assets, 
and  of  possible  threats  by  the  like  assets  of  others,  was 
a  community  already  robustly  on  board  for  a  theory 
of  historical  change  keyed  near  exclusively  to  technol¬ 
ogy.  By  the  early-2000s,  American  military  thinkers 
had  been  captured  by  the  RMA  argument,  had  moved 
on  to  the  transformation  thesis,  and  were  ready  for  the 
next  big  idea  and  its  basket  of  associates,  among  which 
was  cyber. 

How  should  one  think  about  cyberspace?  What 
was  the  promise  in  digital  change?  The  defense  com¬ 
munity  had  spent  a  busy  if  navigationally  rather  un¬ 
certain  decade  teasing  out  any  and  probably  every 
variant  of  meaning  of  the  RMA  thesis.  It  had  passed 
on  from  RMA,  and  was  well  into  transformation  as 
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the  brightest  current  guiding  light,  when  along  came 
real  conflict  in  Afghanistan,  Iraq,  and  then  Afghani¬ 
stan  again.  While  the  U.S.  (and  some  allied)  military 
struggled  to  understand,  and  then,  hopefully,  to  do 
consequentially  what  seemed  necessary  to  be  done  in 
the  2000s,  the  technical  momentum  of  military  revo¬ 
lution  was  posing  a  growing  challenge  to  strategic 
comprehension.  What  happened  was  that  the  pace  of 
technical  change  in  digitization  had  transcended  un¬ 
derstanding  of  what  it  meant  strategically. 

The  RMA  theory  outlined  by  Krepinevich  and 
many  other  analysts  mainly  in  the  early-  and  mid- 
1990s,  was  significantly  bereft  of  strategic  content. 
This  fact  was  not  widely  appreciated  at  the  time,  as 
a  review  of  the  literature  makes  unambiguously  clear 
(and  as  this  theorist  recalls  all  too  plainly).  The  high- 
tech  dazzle  of  RMA,  and  the  evident  sophistication  of 
the  argument  recognizing  the  vital  roles  of  concepts 
and  organizations,  when  pursued  in  a  near-vacuum 
of  major  threat  in  the  1990s  amounted  to  a  strategy- 
free  enterprise.  Why  was  the  United  States  pursuing 
the  latest  RMA  in  the  1990s?  What  desirable  conse¬ 
quences  were  anticipated?  What  was  the  strategic  nar¬ 
rative  that  made  sense  of  the  project?  This  is  to  criti¬ 
cize  neither  the  RMA  enterprise  per  se,  nor  its  product 
and  models  of  transformation.  But  it  is  to  claim  that 
the  whole  effort  was  vitally  short  of  strategic  guid¬ 
ance.  The  ends,  ways,  means  — and  assumptions  —  of 
the  1990s,  were  critically  short  on  holistic  coherence. 
When  exciting  means  and  the  ways  to  employ  them 
are  not  connected  intelligently  to  prudent  political 
ends  (policy),  strategy  worthy  of  the  name  cannot 
function.  So  it  was  for  many  years  when  RMA  was  the 
technology-led,  certainly  enabled,  vision  that  came  to 
function  for  many  as  an  end  in  itself.  Admittedly,  this 
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is  an  ungenerous  judgment  fueled  more  than  margin¬ 
ally  by  hindsight. 

Missing  from  the  unofficial,  but  conceptually  dom¬ 
inant,  RMA  theory  of  the  period,  was  an  adequate  un¬ 
derstanding  of  war  and  strategy.  The  technology-led 
theory  summarized  tersely  in  the  words  of  Krepin- 
evich  quoted  earlier  should  be  regarded  only  as  per¬ 
taining  to  the  components  of  strategic  effectiveness  in 
crisis  and  war.  What  was  wrong  with  the  RMA  theory 
of  the  1990s  was  that  it  confused  unilateral  combat 
power  with  the  net  effectiveness  that  produces  out¬ 
comes  in  strategic  history.35 

I  offer  two  perilously  bold  historical  judgments  in 
support  of  the  argument  just  made.  First,  in  none  of 
the  greater  wars  of  modern  history  has  technologi¬ 
cal  inferiority,  or  related  conceptual  weakness,  been 
a  dominant  cause  of  strategic  success  or  failure.  Of 
course,  the  elements  mentioned  explicitly  by  Krepin- 
evich  matter  seriously  —  technologies,  concepts,  and 
organizations  — but  they  do  not  constitute  a  viably 
full-enough  inventory  of  inputs  to  the  making  of 
strategic  performance.  It  should  be  obvious  from  any 
strategic  historical  evidence  that  war  and  its  warfare 
cannot  reliably  be  tamed  conceptually  and  physically 
by  an  explanation  of  effectiveness  that  omits  every¬ 
thing  beyond  the  equipment,  organization,  and  em¬ 
ployment  of  one  belligerent's  military  assets.  Second, 
it  ought  to  occur  to  us  that  there  has  been  a  strange 
contrast  between  what  we  believed  to  be  the  leading 
edge  of  conceptual  sophistication  in  our  maturing  the¬ 
ory  of  RMA,  then  of  transformation,  and  the  brutal, 
humiliating  reality  of  the  lack  of  convincing  success  in 
Iraq  and  Afghanistan.  How  could  it  happen  that  the 
world's  sole  true  superpower,  one  educated  by  deep 
immersion  in  the  RMA  and  beyond  (but  like)  theoriz- 
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ing  of  more  than  a  decade,  could  have  performed  so 
poorly  in  the  field?  After  all,  strategic  theory  is  invent¬ 
ed  and  developed  only  for  the  purpose  of  advancing 
the  prospects  for  success  in  strategic  practice.36  The 
United  States  that  waged  war  as  it  did  in  the  2000s 
was  a  country  misinformed  by  an  explanation  of  his¬ 
torical  change  carried  in  notable  part  by  a  theory  of 
revolution  that  was  not  fit  for  the  purpose.  This  RMA 
theory  and  its  descendants  are  alive  and  well  in  recent 
efforts  to  make  strategic  sense  of  cyber. 

The  lack  of  strategic  content  worthy  of  the  label 
has  been  noticed  in  the  cyber  literature,  but  it  is  what 
one  would  expect  from  the  organizations  that  gener¬ 
ated  the  RMA  theory  of  the  1990s  and  their  defense 
analysts.  The  point  is  not  that  the  theory  was  wrong 
in  most  of  its  content,  but  rather  that  the  content  could 
not  aspire  plausibly  to  account  for  the  entire  reality 
of  politics  and  war.  A  defense  community  seemingly 
happy  enough  with  an  RMA-cum-transformation 
theory  of  change  in  strategic  history  was  never  likely 
to  be  one  sensitive  to  the  lack  of  strategic  explanation 
about  the  technically  exciting  realities  of  digital  net¬ 
working.  The  current  situation  of  technological  feast 
and  strategic  famine  over  cyber  shows  a  faithful  lin¬ 
earity  from  the  RMA  thought  of  the  1990s.  Indeed,  the 
linearity  can  be  traced  to  the  1950s  and  1960s,  as  noted 
by  Brodie  in  his  War  and  Politics  in  1973.37 

Regarded  at  the  human  and  tactical  level,  war  — 
and  certainly  its  warfare  — is  all  about  the  experience 
of  combat;  as  Clausewitz  insisted,  war  has  a  perva¬ 
sive  "climate,"  consisting  of  "danger,  exertion,  uncer¬ 
tainty,  and  chance."38  However,  war  is  not  about  those 
four  potent  elements.  Clausewitz  is  subtle,  reasonable, 
yet  unmistakably  clear  on  the  role  of  policy  and  the 
politics  that  generate  it.  Given  the  prominence  of  tech- 
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nology  in  our  thinking  about  cyber  and  its  uses,  paus¬ 
ing  to  reflect  briefly  on  the  great  Prussian's  advice  is 
highly  valuable.  He  says: 

If  we  keep  in  mind  that  war  springs  from  some  po¬ 
litical  purpose,  it  is  natural  that  the  prime  cause  of 
its  existence  will  remain  the  supreme  consideration 
in  conducting  it.  That,  however,  does  not  imply  that 
the  political  aim  is  a  tyrant.  It  must  adapt  itself  to  its 
chosen  means,  a  process  which  can  radically  change 
it;  yet  the  political  aim  remains  the  first  consideration. 
Policy,  then,  will  permeate  all  military  operations,  and 
in  so  far  as  their  violent  nature  will  admit,  it  will  have 
a  continuous  influence  on  them.39 

Our  subject  ultimately,  as  it  was  for  Clausewitz,  is 
war,  not  the  waging  of  war.  The  military  means  of  war 
are,  of  course,  vital,  and  they  must  be  allowed  to  influ¬ 
ence-even  "radically  change"  —  the  political  aim.  But 
whether  the  military  means  and  the  grammar  of  its 
use  in  combat  radically  shifts  political  ambition,  the 
conduct  of  war  is  about  politics.  Definitions  of  strat¬ 
egy  are  unambiguous  on  this  conceptually  dominant 
organizing  nostrum:  military  strategy  is  the  direction 
and  use  made  of  force  and  the  threat  of  force  for  the 
purposes  of  policy  as  decided  by  politics. 

It  follows  from  the  logic  in  the  paragraph  above 
that  computer-led  RMA  is  not  and  cannot  be  about 
science  and  technology,  anymore  than  air  power 
is  about  aeronautics  or  nuclear  weapons  are  about 
nuclear  physics  and  engineering.  When  considered 
strategically,  all  three  relatively  recent  RMAs  — air 
power,  nuclear  weapons,  and  cyber  —  are  about  policy 
and  its  politics.  This  is  not  to  deny  that  the  technical 
and  tactical  realities  of  these  three  RMAs  have  been  so 
demanding,  even  seductive  of  attention,  that  their  po¬ 
litical  purpose  frequently  slips  out  of  mind  and  sight. 
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If  today's  military  cybernauts  would  pause  briefly  to 
recognize  that  their  particular  realm  of  technical  fas¬ 
cination  is  but  the  latest  in  a  long  line  of  innovations 
that  have  high  strategic  relevance,  they  might  appreci¬ 
ate  that  the  general  theory  of  strategy  has  meaning  for 
them  and  their  networked  computers,  as  it  did  — in¬ 
deed,  still  does  —  for  networked  railroads,  telephones, 
and  much  else.  The  technical  and  tactical  story  of  digi¬ 
tal  IT  is  important  and  has  to  be  appreciated  on  its  own 
technical  and  tactical  terms,  as  Clausewitz  plainly  al¬ 
lowed,  but  that  story  is  not  the  story  for  contemporary 
strategy.40  It  is  very  important  for  us  not  to  forget  that 
cyber  truly  is  distinctive  as  an  environmental  domain 
for  strategic  behavior,  in  that  its  features  are  not  geo¬ 
physically  constrained  as  are  those  that  bear  on  Land- 
power,  sea  power,  air  power,  and  Earth-orbital  space. 
We  construct  cyberspace,  or  more  accurately  stated, 
we  can  construct  cyberspaces  and  reconstruct  them 
very  rapidly  indeed.  Yes,  the  laws  of  physics  do  rule, 
but  those  laws  do  not  pose  notable  limitations  on  our 
or  our  enemies'  cyber  competence.  When  approached 
strategically,  cyberspace  can  be  what  we  and  our  en¬ 
emies  make  it.  This  can  prove  a  challenging  tactical 
reality  for  us  to  grasp  as  fully  as  we  should. 

If  it  is  reasonable  to  regard  our  ongoing  digital  rev¬ 
olution  as  an  RMA,  there  should  be  some  value  in  con¬ 
sidering  our  historical  experience  with  other  RMAs  in 
the  past.  The  considerable  body  of  theory  and  argu¬ 
able  but  suggestive  historical  experience  with  past 
RMAs  from  the  early-14th  century  to  the  20th  (with 
atomic,  then  hydrogen  bombs  heralding  the  nuclear 
age)  provide  some  basis  for  a  prudent  view  of  cyber.41 
Historical  perspective  encourages  today's  cybernauts 
to  attempt  to  place  the  RMAs  in  the  stream  of  time. 
It  should  be  reassuring,  perhaps  usefully  humbling, 
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to  realize  that  in  the  past,  innovators  and  exploiters 
of  then-exciting  new  manifestations  of  science  and 
technology  needed  to  be  understood  militarily  and 
strategically  for  the  political  purposes  of  their  day. 
One  ought  not  to  venture  on  a  journey  into  specula¬ 
tive  thought  about  cyber  unless  one  is  first  exposed  to 
the  theory  and  history  of  railroads,  the  telegraph,  the 
telephone,  aircraft,  and  nuclear  weapons.  The  reason 
is  not  that  one  needs  to  know  who  did  what,  when, 
and  to  whom,  or  even  what  it  meant  at  the  time  and 
later  (in  answer  to  the  "So  what?"  question).  Rather, 
the  reason  is  simply  to  situate  cyber  by  logical  impli¬ 
cation  in  the  flow  of  strategic  history.  As  is  so  often 
the  case  in  strategic  inquiry,  appreciation  of  context 
is  essential. 

Cyber  unquestionably  is  of  major  importance,  but 
the  assumptions  that  one  makes  about  it  before  exam¬ 
ining  it  closely  can  hardly  help  but  shape  the  assess¬ 
ment.  Engineers  and  tacticians  who  are  making  sense 
of  networked  computers  for  current  use  can  hardly 
help  but  be  over  impressed  by  the  technical  wonder  of 
the  machinery  at  their  disposal.  But  if  we  are  to  under¬ 
stand  what  is  happening  with  the  computer  — whither 
it  is  likely  to  proceed,  and  what  this  is  likely  to  mean 
strategically —we  need  help  derived  from  the  his¬ 
torical  context  of  past  RMAs  and  from  the  conceptual 
context,  which  can  only  be  provided  by  the  general 
theory  of  strategy. 


32 


STRATEGIC  EFFECTIVENESS 


Net  Assessment. 

War  and  its  warfare  are  decided  by  superiority  in 
net  strategic  effectiveness.42  Many  factors  contribute  to 
that  effectiveness,  and  the  strategic  leverage  granted 
by  each  factor  varies  from  war  to  war  and  even  over 
time  and  in  different  geographies  in  the  same  war. 
However,  the  constituents  of  strategic  effectiveness 
comprise  a  constant  list,  even  though  their  specific 
values  are  highly  variable.  The  general  theory  of  strat¬ 
egy  tells  us  what  makes  strategic  effectiveness,  and 
not  least  among  its  dicta  is  the  insistence  that  strategy 
is  pervasively  adversarial  in  nature  and  in  character. 
When  enemies  are  not  plainly  identifiable,  defense 
communities  need  to  hypothesize  about  future  perils. 
We  know  too  little  for  true  comfort  about  the  iden¬ 
tity  and  intensity  of  future  insecurities,  but  we  can  be 
certain  that  feelings  of  danger  —  close  or  more  distant 
—  assuredly  lurk  in  the  years  to  come.  Also,  we  know 
that  our  objective  and  subjective  security  situation  in 
the  future  has  to  be  anticipated  and  then  judged  by 
net  assessment.43  The  strength  of  America  cannot  be 
the  issue,  because  this  has  meaning  for  strategy  only 
when  it  is  understood  as  a  relational  variable. 

Our  cyber  literature  is  generally  unsatisfactory  in 
its  treatment  both  of  prospective  strategic  benefit  to 
us  and  in  its  limited  grasp  of  the  necessary  contex- 
tualization  in  war  and  warfare.  Unsound  analogy  is 
part  of  the  explanation  for  these  weaknesses.  The  first 
step  that  needs  to  be  taken  toward  understanding  the 
strategic  meaning  of  cyber  is  recognition  that  when  it 
is  appreciated  strategically,  rather  than  tactically  or 
technically,  America's  cyber  performance  is  a  team 
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player  prospectively  opposing  other  countries'  teams. 
In  other  words,  American  cyber  would  contribute  to 
American  strategic  performance  against  enemies  who 
assuredly  will  be  different  from  America  in  many 
respects,  but  not  when  weighed  in  the  ever-shifting 
assay  of  net  strategic  effectiveness.  No  matter  how 
asymmetric  belligerents  may  be,  in  a  vital  and  objec¬ 
tive  sense  the  net  merit  in  their  competitive  strategic 
endeavors  is  graded  and  registered  in  a  single  unique 
course  of  events. 

One  needs  always  to  bear  in  mind  that  the  inter¬ 
national  strife  of  the  day  and  its  occasional  realization 
in  military  action  are  always  about  politics.  Moreover, 
political  objectives  are  gained  or  frustrated  in  good 
part  by  net  strategic  effectiveness.  This  argument  does 
not  diminish  cyber;  rather,  it  reminds  the  cyber  com¬ 
munity  that  it  too  is  on  the  team  and  is  not  the  whole 
national  security  team  itself.  Debate  about  cyber  some¬ 
times  strays  toward  the  claim  that  cyber  power  might 
be  the  strategy  team. 

Because  cyberspace  is  geophysically  so  extraordi¬ 
nary,  there  is  indeed  an  important  sense  in  which  it  is 
extra-physical,  beyond  geography.  This  line  of  thought 
has  some  limited  merit,  but  it  is  obvious  that  much  of 
what  helps  to  make  cyberspace,  let  alone  those  who 
make  it,  is  distinctly  physical.  However,  even  if  cy¬ 
berspace  truly  were  as  geophysically  extraordinary  in 
its  uniqueness  as  some  like  to  argue  and  emphasize, 
ipso  facto  that  would  not  mean  that  this  domain  has  the 
potential  to  be  exploited  for  exceptional  strategic  ef¬ 
fectiveness.  One  must  hasten  to  point  out  that  the  idea 
that  cyber  power  could  be  a  war-winner,  or,  at  least, 
the  key  player  on  the  national  security  team,  is  by  no 
means  absurd.  Indeed,  it  is  prudent  for  defense  ana¬ 
lysts  today  to  explore  and  examine  the  net  strategic 
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promise  in  cyber  power  to  see  how  great  its  strategic 
benefits  and  dangers  might  be. 

While  much  about  cyber  is  cloaked  either  in  offi¬ 
cial  secrecy  or  is  shrouded  in  a  fog  of  uncertainty  be¬ 
cause  of  the  subject's  immaturity,  nonetheless  it  is  safe 
enough  to  say  now  that  cyber  peril  should  not  be  re¬ 
garded  as  a  nuclear-like  danger  or  set  of  dangers.  This 
is  not  necessarily  to  claim  that  we  should  be  relaxed 
about  the  inherent  risks  in  our  computer-networked 
existence,  but  it  is  to  insist  that  cyber  attack  is  not  at 
all  credibly  comparable  to  a  nuclear  option.  This  claim 
is  controversial  to  those  of  a  "Cybergeddon"  persua¬ 
sion,  but  it  would  be  a  useful  step  forward  for  stra¬ 
tegic  net  assessment  were  the  more  extreme  disaster 
scenarios  labeled  clearly  as  the  nonsense  that  they  are. 
Krepinevich  is  convincing  when  he  argues  that: 

[Djespite  the  assertions  of  some,  it  also  seems  likely 
that  cyber  weapons  have  nowhere  near  the  ability  to 
inflict  catastrophic  destruction  as  that  of  a  major  nu¬ 
clear  attack.  .  .  .  Simply  put,  nuclear  weapons  remain 
in  a  class  all  their  own.44 

The  same  judgment  is  advanced  by  a  techni¬ 
cally  more  expert  source  on  cyber,  Martin  C.  Libicki, 
who  holds  that  "[njuclear  warfare  trumps  all  other 
forms."45  Libicki  may  be  wrong,  but  he  advances  and 
defends  this  conviction  with  no  little  authority.  Given 
our  ignorance  of  future  technical  feasibility,  it  has 
been  necessary  to  examine  the  full  range  of  possibility 
on  the  scale  of  threats  by  cyber.  But  the  extra-physi- 
cality  of  the  menace,  and  its  substantially  discretion¬ 
ary  character  —  dependent  as  the  menace  has  to  be  on 
our  technical  and  tactical  choices  —  means  that  nuclear 
menace  continues  unchallenged  as  a  survival-level 
danger  that  could  be  caused  by  hostile  strategic  intent. 
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In  short,  on  the  evidence  of  careful,  if  limited,  assess¬ 
ment  to  date,  cyber  is  not  akin  to  nuclear  peril,  and 
hypothetical  nuclear  analogies  are  more  likely  to  mis¬ 
lead  governments  and  frighten  the  public  needlessly 
than  they  are  to  educate  and  warn  prudently.46 

Analogy,  Tactical  and  Strategic. 

It  matters  profoundly  whether  nuclear  analogy  is 
appropriate  for  cyber.  It  is  ironic,  and  it  may  even  be 
one  of  strategic  history's  few  paradoxes,  that  some¬ 
how  we  have  learnt  to  live  with  ineradicable  nuclear 
facts.  This  is  reality,  despite  the  continuing  awesome 
uncertainties  that  surround  its  likely  meaning  if  ex¬ 
pressed  in  violent  military  behavior.  To  some,  indeed 
possibly  to  many,  people  who  have  sought  to  under¬ 
stand  cyber  power,  its  possibilities  have  appeared 
strategically  unbounded.  It  can  be  difficult,  if  not  im¬ 
possible,  to  prove  a  negative.  How  can  we  be  sure  that 
cyber  threats  are  not  of  a  scale,  notwithstanding  their 
definitional  nonphysicality,  that  begs  plausibly  for 
comparison  with  what  is  now  usually  regarded  in  the 
main  as  yesterday's  menace  —  nuclear  attack? 

Several  categories  of  response  can  be  offered  to  the 
alleged  relevance  of  nuclear  analogy,  but  suffice  it  for 
now  to  cite  but  two.  First,  except  for  highly  unusual 
cases,  cyber  power  is  confined  in  its  damaging  effects 
to  cyberspace.  This  is  not  to  understate  the  problems 
that  can  be  caused  by  cyber  attack,  but  it  is  to  claim 
firmly  that  the  kind  of  damage  and  disruption  that  cy¬ 
ber  might  affect  cannot  compare  with  the  immediate 
and  more  lasting  harm  that  nuclear  weapons  certainly 
would  cause.  This  is  not  guesswork.  It  is  simply  fool¬ 
ish  to  argue  that  understanding  of  cyber  peril  can  be 
much  advanced  by  nuclear  analogy. 
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Nonetheless,  analogy  is  critically  important  in  our 
efforts  to  grasp  what  cyber  power  means  strategically. 
Because  strategy  must  be  done  tactically,  it  is  not  pos¬ 
sible  to  assess  cyber  strategically  without  grasping  the 
tactical  (and  technical)  narrative.  That  plainly  being 
so,  the  understanding  of  cyber  must  be  founded  upon 
our  best  contemporary  judgments  regarding  what  is 
and  is  not  possible  in  and  through  cyberspace.  Ana¬ 
lysts  have  drafted  an  analogy  to  help  unravel  cyber's 
nature,  character,  and  meaning.  While  respectful  of 
their  efforts  and  achievements,  I  believe  that  the  most 
helpful  way  to  enlist  an  analogy  for  enhanced  under¬ 
standing  is  to  recognize  the  relevance  of  the  analogy 
in  critically  distinguishing  between  strategic  and  tacti¬ 
cal  enquiry.  This  elementary  and  commonplace  binary 
distinction  is  preferable  to  an  elaborate  conceptualiza¬ 
tion  that  requires  historical  data  to  serve  an  evidential 
function  that  is  beyond  it. 

1.  Strategic  analogy:  Cyber  is  an  informational 
tool  of  a  particular  kind,  totally  dependent  on  the 
exploitation  of  the  EMS.  But  the  technical  and  tacti¬ 
cal  detail  of  cyber  is  of  no  relevance  to  the  matter  of 
cyber's  identity  and  role(s)  as  a  tool  of  strategy.  Of 
course,  those  details  are  important,  but  they  are  im¬ 
portant  only  with  respect  to  the  strategic  tasks  that 
cyber  can  and  cannot  perform.  The  general  theory  of 
strategy  explains  functionally  what  its  instruments  do 
and  why  they  do  it.  Each  of  the  five  operational  do¬ 
mains  of  national  military  strategy  has  a  unique  tech¬ 
nical  and  tactical  story,  albeit  with  considerable  over¬ 
lap  among  them;  the  geophysical  domains  of  land, 
sea,  air  and  Earth-orbital  space  are  each  somewhat 
porous,  as  elements  of  other  domains  have  some  in¬ 
fluence  on,  through,  and  because  of  them.  Even  the  ex- 
tra-physicality  of  the  electrons  of  the  EMS  assembled 
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and  directed  as  the  information  collected  and  moved 
as  cyber  cannot  be  immune  to  the  material  context  in 
which  and  for  which  those  electrons  are  employed. 
But  the  specific  technical  and  tactical  details  scarcely 
signify  comprehension  as  agents  of  strategy,  as  it  is 
generally  understood.  The  understanding  of  cyber  has 
to  begin  with  the  general  theory  of  strategy,  because 
if  it  does  not,  it  is  very  likely  that  strategically  un¬ 
dereducated  people  will  confuse  the  tactical  with  the 
strategic.  For  example,  the  theory  of  cyber  in  war  (i.e., 
cyber  warfare)  may  well  be  mistaken  for  the  theory  of 
war  as  a  whole.  This  happened  with  air  power,  came 
close  to  happening  with  sea  power,  and  with  some, 
but  only  some,  good  reason,  did  happen  for  a  while 
with  nuclear  weapons.  All  weapons  have  to  be  located 
conceptually  and  unambiguously  under  the  common 
conceptual  umbrella  provided  by  the  general  theory 
of  strategy.  This  is  both  logically  correct  and  politi¬ 
cally  and  militarily  essential  for  the  purpose  of  keep¬ 
ing  tools  properly  labeled  only  as  such,  no  matter  how 
novel  and  exciting  they  appear  at  the  time. 

2.  Tactical  analogy:  Cyber  power  is  not  like  other 
kinds  of  military  power;  all  of  the  others  have  physi¬ 
cal  reality  and  can  engage  physically  with  the  rest. 
Cyber  can  be  assaulted  physically  by  action  against 
the  machines  and  people  that  generate  it,  but  cyber  at¬ 
tack  is  utterly  different  in  its  essential  nonphysicality. 
When  considering  cyber  action,  one  needs  to  put  to 
one  side  the  kinetic  and  maneuverist  ideas  that  in  the 
main  have  shaped  and  then  driven  our  military  en- 
culturation,  no  matter  which  physical  environment  is 
our  principal  focus.  In  part  because  cyber  has  come  to 
be  appreciated  and  discussed  as  a  weapon,  friendly  or 
hostile,  it  is  easy  to  forget  that  functionally  regarded, 
it  should  be  located  in  the  long  history  of  informa- 
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tion  and  communication.  This  can  be  so  obvious  an 
enduring  fact  that  it  is  neglected,  and  soldiers  may  be 
straining  against  physics  as  they  strive  to  conceptual¬ 
ize  computer  networks  in  terms,  and  even  for  some 
purposes,  that  are  fundamentally  alien  to  what  can  be 
done  via  the  EMS.  Cyber  has  to  be  approached  and 
can  be  exploited  only  on  its  own  scientific  terms.  It  is 
perhaps  ironic  that  the  physics  of  cyberspace  on  the 
one  hand  are  rigidly  nonpermissive  of  physical  action, 
while  on  the  other  they  are  thoroughly  permissive  of 
discretionary  construction  effort.  Cyberspaces,  em¬ 
phatically  plural,  are  very  much  what  we  choose  to 
make  them. 

This  is  not  so  for  the  other  four  geographies  of 
warfare.  Gravity  and  the  laws  of  planetary  motion 
codified  by  Johannes  Kepler  (1571-1630)  are  absolute 
sources  of  physical  constraint  on  military  effort.  The 
physics  of  seawater  cannot  be  ignored  and  evaded  in 
ship  design  and  propulsion,  while  the  technical  chal¬ 
lenges  of  aeronautics  continue  to  be  nontrivial.  As  for 
Landpower,  terrain,  vegetation,  climate,  and  weather, 
these  are  all  permanent  sources  of  some  limitation. 
The  cyberspace  we  use  is  that  which  we  have  cho¬ 
sen.  If  that  cyberspace  is  found  vulnerable  to  attack, 
or  unexpectedly  prone  to  technical  failure,  the  fault 
will  be  ours.  This  cannot  be  said  in  these  terms  of 
the  land,  sea,  air,  and  Earth-orbital  military  domains. 
This  important,  even  crucial  argument,  has  been  made 
convincingly  by  those  who  are  steeped  in  the  science 
and  technology  of  cyber,  but  still,  appreciation  of  it  is 
nowhere  near  as  widespread  as  it  should  and  needs 
to  be.  If  we  are  lethally  vulnerable  to  harm  in  our  use 
of  cyberspace,  it  will  largely,  if  not  wholly,  be  our 
own  fault. 


39 


The  contrast  with  nuclear  danger  could  hardly  be 
more  obvious.  Because  of  their  nature,  nuclear  weap¬ 
ons  have  never  (since  the  early-1950s  at  least)  offered 
the  plausible  prospect  of  use  in  a  war  that  we  could 
choose  to  conduct  with  only  acceptable  friendly  dam¬ 
age  being  the  most  likely  result.  Arguably,  air  defense 
and  later  missile  defense  have  been  more  possible  and 
strategically  useful  than  the  dominant  theory  and  offi¬ 
cial  U.S.  position  held.  But  even  if  optimistic  judgment 
about  active  defense  was  substantially  correct,  though 
doctrinally  unpopular,  there  is  little  doubt  that  nation¬ 
al  survival  was  always  potentially  at  risk.47  The  con¬ 
trast  with  cyber  peril  is  stark.  Such  danger  certainly 
is  avoidable  by  our  own  endeavors  for  cyber  security, 
while  cyber  damage  has  to  be  accepted  as  a  tolerated 
cost  of  superpower  duty  that  we  anticipate  and  with 
which  we  intend  to  cope  well  enough.  Our  cyberspace 
will  be  disrupted,  harassed,  and  hurt,  but  that  can 
be  said  sadly  with  confidence  of  our  Landpower,  sea 
power,  air  power,  and  also  space  power,  to  resort  to 
a  familiar  thought,  though  with  an  exclamation  mark 
rather  than  a  question  mark,  "So  what!" 

We  cannot  safely  learn  about  cyber's  meaning 
through  tactical  and  technical  analogy  from  the  oth¬ 
er  military  domains.  However,  when  we  plug  cyber 
into  a  conceptual  world  view  educated  by  the  general 
theory  of  strategy  that  is  alert  to  the  course  of  events 
over  the  long  term,  the  technology  and  the  tactics  of 
our  EMS  exploitation  today  become  much  easier  to 
understand.  War  and  strategy  for  its  conduct  are  to 
be  thought  of  as  a  deadly  duel.  Also,  because  (unlike 
nuclear  weapons)  cyber  power  is  not  potentially  an 
instrument  of  mass  destruction— probably  not  even 
of  long-lasting  mass  disruption  if  we  choose  to  be  at¬ 
tentive  to  cyber  security  —  there  is  no  obvious  reason 
why  the  entirely  standard  dynamics  of  competition 
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will  not  apply.  Yes,  cyber  power  is  radically  different, 
but  it  is  not  different  in  ways  that  must  hinder  fatally 
the  working  of  the  offense-defense  relationship  that 
has  been  familiar  in  the  other  geographies  of  strate¬ 
gic  concern  for  so  long.  Although  it  continues  to  be 
orthodox  to  assert  that  cyberspace  is  by  its  scientific 
nature  an  environment  friendly  to  offense,  rather  than 
defense,  this  fashionable  belief  almost  certainly  either 
is  wrong,  or,  to  be  generous,  is  seriously  misleading. 
On  November  10, 1932,  Stanley  Baldwin  was  not  cor¬ 
rect  when  he  claimed  that  "the  bomber  will  always  get 
through,"  at  least  it  would  not  get  through  well  pre¬ 
pared  defenses  in  strategically  lethal  numbers  able  to 
attack  critical  targets.48  Some  bombers  certainly  would 
penetrate  air  defenses,  but  so  what?  Britain  prepared 
to  be  able  to  accept  damage  but  to  fight  on.  This  is  the 
approach  that  appears  most  suitable  to  the  challenge 
of  damage  from  cyberspace.  Cyber  offense  will  regis¬ 
ter  some  success,  but  so  what? 

In  the  context  of  all  the  factors  that  play  in  interna¬ 
tional  politics,  war,  strategy,  and  warfare,  the  strategic 
history  of  cyber  must  reflect  the  course  and  relative 
weight  of  tactical  success  and  failure.  As  indicated 
earlier,  it  is  important  not  to  strip  cyberspace,  cyber 
power,  and  the  strategy  for  cyber  of  the  context  that  is 
absolutely  required  to  give  them  meaning.  The  latest 
focus  of  military  and  strategic  interest,  which  is  to  say, 
nuclear  weapons  in  the  recent  past  and  the  networked 
computer  (cyber)  today  have  an  attractive  power,  an 
all  but  gravitational  pull,  deriving  in  part  from  the 
excitement  they  promote  in  a  distinctly  technically 
oriented  American  defense  community.  The  technical 
experts  do  not  so  much  reject  the  politics  and  strategy 
that  alone  are  sources  of  meaning;  rather,  they  largely 
ignore  them. 
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It  is  somewhat  reassuring  to  be  able  to  reach  the 
interim  conclusion  registered  in  the  secondary  title  to 
this  monograph,  "The  sky  is  not  falling."  Undoubtedly, 
the  Information  Age  in  cyberized  form  is  still  young. 
Indeed,  it  is  so  young  that  one  should  hesitate  before 
declaiming  any  firm  position  on  the  strategic  mean¬ 
ing  of  cyber.  That  said,  it  is  useful  to  record  a  short 
list  of  the  more  important  apparent  facts  about  cyber 
power  that  have  clear  strategic  implications.  What  I 
have  done  is  select  the  more  significant  candidate  facts 
and  judgments  about  cyber  power.  I  must  preface  this 
shortlist  with  the  historical  comment  that  every  one  of 
the  now  traditional  (including  Earth-orbital  space)  en¬ 
vironmental  domains  has  recorded  a  technical-tactical 
narrative  of  offense  and  defense.  There  has  been  a  per¬ 
sisting  pressing  reason  for  this  competitive  dynamic. 
When  a  geography  becomes  militarily  and  usefully 
exploitable,  the  logic  is  inexorable  that  holds  that  such 
exploitation  is  worth  denying  to  rivals  and  enemies. 
Technical  accomplishment  in  the  offense-defense 
nexus  fluctuates  with  the  technological  achievements 
of  the  period,  but  over  the  longer  term,  military  (and 
militarily  relevant)  machines  themselves  rarely  can  be 
claimed  credibly  to  have  been  the  decisive  factor  in 
strategic  history. 

If  some  belligerents  enjoyed  superior  mechani¬ 
cal  military  muscle,  there  were  broader  societal  and 
political  reasons  quite  distinct  from  the  technology 
why  that  was  so.  Weapons  do  not  win  and  lose  wars; 
people  and  their  societies  do.  Nuclear  weapons  ap¬ 
pear  not  incredibly  to  be  historically  distinctive,  even 
unique,  in  that  their  unit  destructiveness  is  so  great, 
albeit  variable,  that  the  standard  dynamics  of  offense 
and  defense  have  yet  to  produce  a  true  tactical  bal¬ 
ance.  But  as  best  we  can  tell  today,  cyber  has  little  in 
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common  with  nuclear  weaponry.  So  thoroughly  does 
cyber  power  depend  upon  the  details  of  humanly 
constructed  cyberspaces  that  it  is  not  scientifically 
accurate  to  conceive  of  a  single  cyberspace  as  consti¬ 
tuting  a  single  great  common,  akin  to  the  sea,  the  air, 
and  Earth-orbital  space.  This  is  not  mere  academic 
pedantry,  because  the  effectively  limitless  possibili¬ 
ties  of  constructed  cyberspace(s)  mean  that  cyber  of¬ 
fense  should  confront  a  tactical-technical  challenge  in 
which  the  systemic  advantage  resides  inherently  with 
the  defender.  It  is  true  that  offensive  success  in  cyber¬ 
space  may  be  achievable  by  surprise,  but  repair  and 
recovery  by  the  defender  ought  to  be  fairly  routine. 
Good  practice  in  cyber  security  includes  preparation 
to  suffer  some  disruption,  but  then  to  recover  rapidly, 
not  seriously  impaired.  I  do  not  imply  that  this  is  easy 
or  cheap,  but  on  the  limited  evidence  of  experience  to 
date,  and  in  the  light  of  the  physics  of  the  EMS,  this 
approach  appears  to  be  the  most  prudently  realistic. 

CONCLUSIONS  AND  RECOMMENDATIONS: 
THE  SKY  IS  NOT  FALLING 

This  analysis  has  sought  to  explore,  identify,  and 
explain  the  strategic  meaning  of  cyber  power.  The  or¬ 
ganizing  and  thematic  question  that  has  shaped  and 
driven  the  inquiry  has  been  "So  what?"  Today  we 
all  do  cyber,  but  this  behavior  usually  has  not  been 
much  informed  by  an  understanding  that  reaches  be¬ 
yond  the  tactical  and  technical.  I  have  endeavored  to 
analyze  in  strategic  terms  what  is  on  offer  from  the 
largely  technical  and  tactical  literature  on  cyber.  What 
can  or  might  be  done  and  how  to  go  about  doing  it 
are  vitally  important  bodies  of  knowledge.  But  at  least 
as  important  is  understanding  what  cyber,  as  a  fifth 
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domain  of  warfare,  brings  to  national  security  when  it 
is  considered  strategically.  Military  history  is  stocked 
abundantly  with  examples  of  tactical  behavior  un¬ 
guided  by  any  credible  semblance  of  strategy.  This 
inquiry  has  not  been  a  campaign  to  reveal  what  cy¬ 
ber  can  and  might  do;  a  large  literature  already  exists 
that  claims  fairly  convincingly  to  explain  "how  to  .  . 
But  what  does  cyber  power  mean,  and  how  does  it  fit 
strategically,  if  it  does?  These  Conclusions  and  Rec¬ 
ommendations  offer  some  understanding  of  this  fifth 
geography  of  war  in  terms  that  make  sense  to  this 
strategist,  at  least. 

1.  Cyber  can  only  be  an  enabler  of  physical  ef¬ 
fort.  Stand-alone  (popularly  misnamed  as  "strategic") 
cyber  action  is  inherently  grossly  limited  by  its  im¬ 
materiality.  The  physicality  of  conflict  with  cyber's 
human  participants  and  mechanical  artifacts  has  not 
been  a  passing  phase  in  our  species'  strategic  history. 
Cyber  action,  quite  independent  of  action  on  land,  at 
sea,  in  the  air,  and  in  orbital  space,  certainly  is  pos¬ 
sible.  But  the  strategic  logic  of  such  behavior,  keyed 
to  anticipated  success  in  tactical  achievement,  is  not 
promising.  To  date,  "What  if  .  .  ."  speculation  about 
strategic  cyber  attack  usually  is  either  contextually 
too  light,  or,  more  often,  contextually  unpersuasive.49 
However,  this  is  not  a  great  strategic  truth,  though  it 
is  a  judgment  advanced  with  considerable  confidence. 
Although  societies  could,  of  course,  be  hurt  by  cyber 
action,  it  is  important  not  to  lose  touch  with  the  fact, 
in  Libicki's  apposite  words,  that  "[i]n  the  absence  of 
physical  combat,  cyber  war  cannot  lead  to  the  occupa¬ 
tion  of  territory.  It  is  almost  inconceivable  that  a  suf¬ 
ficiently  vigorous  cyber  war  can  overthrow  the  adver¬ 
sary's  government  and  replace  it  with  a  more  pliable 
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one."50  In  the  same  way  that  the  concepts  of  sea  war, 
air  war,  and  space  war  are  fundamentally  unsound,  so 
also  the  idea  of  cyber  war  is  unpersuasive. 

It  is  not  impossible,  but  then,  neither  is  war  con¬ 
ducted  only  at  sea,  or  in  the  air,  or  in  space.  On  the 
one  hand,  cyber  war  may  seem  more  probable  than 
like  environmentally  independent  action  at  sea  or  in 
the  air.  After  all,  cyber  warfare  would  be  very  un¬ 
likely  to  harm  human  beings  directly,  let  alone  dam¬ 
age  physically  the  machines  on  which  they  depend. 
These  near-facts  (cyber  attack  might  cause  socially 
critical  machines  to  behave  in  a  rogue  manner  with 
damaging  physical  consequences)  might  seem  to  ren¬ 
der  cyber  a  safer  zone  of  belligerent  engagement  than 
would  physically  violent  action  in  other  domains. 
But  most  likely  there  would  be  serious  uncertainties 
pertaining  to  the  consequences  of  cyber  action,  which 
must  include  the  possibility  of  escalation  into  other 
domains  of  conflict.  Despite  popular  assertions  to 
the  contrary,  cyber  is  not  likely  to  prove  a  precision 
weapon  anytime  soon.51  In  addition,  assuming  that 
the  political  and  strategic  contexts  for  cyber  war  were 
as  serious  as  surely  they  would  need  to  be  to  trigger 
events  warranting  plausible  labeling  as  cyber  war,  the 
distinctly  limited  harm  likely  to  follow  from  cyber  as¬ 
sault  would  hardly  appeal  as  prospectively  effective 
coercive  moves.  On  balance,  it  is  most  probable  that 
cyber's  strategic  future  in  war  will  be  as  a  contribut¬ 
ing  enabler  of  effectiveness  of  physical  efforts  in  the 
other  four  geographies  of  conflict.  Speculation  about 
cyber  war,  defined  strictly  as  hostile  action  by  net¬ 
worked  computers  against  networked  computers,  is 
hugely  unconvincing. 

2.  Cyber  defense  is  difficult,  but  should  be  suffi¬ 
ciently  effective.  The  structural  advantages  of  the  of- 


45 


fense  in  cyber  conflict  are  as  obvious  as  they  are  easy 
to  overstate.  Penetration  and  exploitation,  or  even 
attack,  would  need  to  be  by  surprise.  It  can  be  swift 
almost  beyond  the  imagination  of  those  encultured 
by  the  traditional  demands  of  physical  combat.  Cyber 
attack  may  be  so  stealthy  that  it  escapes  notice  for  a 
long  while,  or  it  might  wreak  digital  havoc  by  com¬ 
plete  surprise.  And  need  one  emphasize,  that  at  least 
for  a  while,  hostile  cyber  action  is  likely  to  be  hard 
(though  not  quite  impossible)  to  attribute  with  a  cy- 
berized  equivalent  to  a  "smoking  gun."  Once  one  is  in 
the  realm  of  the  catastrophic  "What  if  . . . ,"  the  world 
is  indeed  a  frightening  place.  On  a  personal  note,  this 
defense  analyst  was  for  some  years  exposed  to  highly 
speculative  briefings  that  hypothesized  how  unques¬ 
tionably  cunning  plans  for  nuclear  attack  could  so 
promptly  disable  the  United  States  as  a  functioning 
state  that  our  nuclear  retaliation  would  likely  be  still¬ 
born.  I  should  hardly  need  to  add  that  the  briefers  of 
these  Scary  Scenarios  were  obliged  to  make  a  series  of 
Heroic  Assumptions. 

The  literature  of  cyber  scare  is  more  than  mildly 
reminiscent  of  the  nuclear  attack  stories  with  which 
I  was  assailed  in  the  1970s  and  1980s.  As  one  may 
observe  regarding  what  Winston  Churchill  wrote  of 
the  disaster  that  was  the  Gallipoli  campaign  of  1915, 
"[t]he  terrible  'Its'  accumulate."52  Of  course,  there 
are  dangers  in  the  cyber  domain.  Not  only  are  there 
cyber-competent  competitors  and  enemies  abroad; 
there  are  also  Americans  who  make  mistakes  in  cyber 
operation.  Furthermore,  there  are  the  manufacturers 
and  constructors  of  the  physical  artifacts  behind  (or 
in,  depending  upon  the  preferred  definition)  cyber¬ 
space  who  assuredly  err  in  this  and  that  detail.  The 
more  sophisticated  — usually  meaning  complex  — the 
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code  for  cyber,  the  more  certain  must  it  be  that  mis¬ 
takes  both  lurk  in  the  program  and  will  be  made  in 
digital  communication. 

What  I  have  just  outlined  minimally  is  not  a  reluc¬ 
tant  admission  of  the  fallibility  of  cyber,  but  rather  a 
statement  of  what  is  obvious  and  should  be  anticipat¬ 
ed  about  people  and  material  in  a  domain  of  war.  All 
human  activities  are  more  or  less  harassed  by  friction 
and  carry  with  them  some  risk  of  failure,  great  or  small. 
A  strategist  who  has  read  Clausewitz,  especially  Book 
One  of  On  War,53  will  know  this.  Alternatively,  anyone 
who  skims  my  summary  version  of  the  general  theory 
of  strategy  will  note  that  Dictum  14  states  explicitly 
that  "Strategy  is  more  difficult  to  devise  and  execute 
than  are  policy,  operations,  and  tactics:  friction  of  all 
kinds  comprise  phenomena  inseparable  from  the  mak¬ 
ing  and  execution  of  strategies."54  Because  of  its  often 
widely  distributed  character,  the  physical  infrastruc¬ 
ture  of  an  enemy's  cyber  power  is  typically,  though 
not  invariably,  an  impracticable  target  set  for  physical 
assault.  Happily,  this  probable  fact  should  have  only 
annoying  consequences.  The  discretionary  nature  and 
therefore  the  variable  possible  characters  feasible  for 
friendly  cyberspace(s),  mean  that  the  more  danger¬ 
ous  potential  vulnerabilities  that  in  theory  could  be 
the  condition  of  our  cyber-dependency  ought  to  be 
avoidable  at  best,  or  bearable  and  survivable  at  worst. 
Libicki  offers  forthright  advice  on  this  aspect  of  the 
subject  that  deserves  to  be  taken  at  face  value: 

[Tjhere  is  no  inherent  reason  that  improving  informa¬ 
tion  technologies  should  lead  to  a  rise  in  the  amount 
of  critical  information  in  existence  (for  example,  the 
names  of  every  secret  agent).  Really  critical  informa¬ 
tion  should  never  see  a  computer;  if  it  sees  a  computer, 
it  should  not  be  one  that  is  networked;  and  if  the  com¬ 
puter  is  networked,  it  should  be  air-gapped.55 
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Cyber  defense  admittedly  is  difficult  to  do,  but  so 
is  cyber  offense.  To  quote  Libicki  yet  again,  "[i]n  this 
medium  [cyberspace]  the  best  defense  is  not  neces¬ 
sarily  a  good  offense;  it  is  usually  a  good  defense."56 
Unlike  the  geostrategic  context  for  nuclear-framed 
competition  in  U.S. -Soviet/ Russian  rivalry,  the  geo¬ 
graphical  domain  of  cyberspace  definitely  is  defensi¬ 
ble.  Even  when  the  enemy  is  both  clever  and  lucky,  it 
will  be  our  own  design  and  operating  fault  if  he  is  able 
to  do  more  than  disrupt  and  irritate  us  temporarily. 

When  cyber  is  contextually  regarded  properly  — 
which  means  first,  in  particular,  when  it  is  viewed  as 
but  the  latest  military  domain  for  defense  planning  —  it 
should  be  plain  to  see  that  cyber  performance  needs  to 
be  good  enough  rather  than  perfect.57  Our  Landpow- 
er,  sea  power,  air  power,  and  prospectively  our  space 
systems  also  will  have  to  be  capable  of  accepting  com¬ 
bat  damage  and  loss,  then  recovering  and  carrying  on. 
There  is  no  fundamental  reason  that  less  should  be  de¬ 
manded  of  our  cyber  power.  Second,  given  that  cyber 
is  not  of  a  nature  or  potential  character  at  all  likely  to 
parallel  nuclear  dangers  in  the  menace  it  could  con¬ 
tain,  we  should  anticipate  international  cyber  rivalry 
to  follow  the  competitive  dynamic  path  already  fol¬ 
lowed  in  the  other  domains  in  the  past.  Because  the 
digital  age  is  so  young,  the  pace  of  technical  change 
and  tactical  invention  can  be  startling.  However,  the 
mechanization  RMA  of  the  1920s  and  1930s  recorded 
reaction  to  the  new  science  and  technology  of  the  time 
that  is  reminiscent  of  the  cyber  alarmism  that  has  flour¬ 
ished  of  recent  years.58  We  can  be  confident  that  cyber 
defense  should  be  able  to  function  well  enough,  given 
the  strength  of  political,  military,  and  commercial  mo¬ 
tivation  for  it  to  do  so.  The  technical  context  here  is 
a  medium  that  is  a  constructed  one,  which  provides 
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air-gapping  options  for  choice  regarding  the  extent  of 
networking.  Naturally,  a  price  is  paid  in  convenience 
for  some  closing  off  of  possible  cyberspace(s),  but  all 
important  defense  decisions  involve  choice,  so  what  is 
novel  about  that?  There  is  nothing  new  about  accept¬ 
ing  some  limitations  on  utility  as  a  price  worth  paying 
for  security. 

3.  Intelligence  is  critically  important,  but  informa¬ 
tion  should  not  be  overvalued.  The  strategic  history 
of  cyber  over  the  past  decade  confirms  what  we  could 
know  already  from  the  science  and  technology  of  this 
new  domain  for  conflict.  Specifically,  cyber  power  is 
not  technically  forgiving  of  user  error.  Cyber  warriors 
seeking  criminal  or  military  benefit  require  precise 
information  if  their  intended  exploits  are  to  succeed. 
Lucky  guesses  should  not  stumble  upon  passwords, 
while  efforts  to  disrupt  electronic  Supervisory  Con¬ 
trol  and  Data  Acquisition  (SCAD A)  systems  ought  to 
be  unable  to  achieve  widespread  harmful  effects.  But 
obviously  there  are  practical  limits  to  the  air-gap  op¬ 
tion,  given  that  control  (and  command)  systems  need 
to  be  networks  for  communication.  However,  Internet 
connection  needs  to  be  treated  as  a  potential  source  of 
serious  danger. 

It  is  one  thing  to  be  able  to  be  an  electronic  nuisance, 
to  annoy,  disrupt,  and  perhaps  delay.  But  it  is  quite 
another  to  be  capable  of  inflicting  real  persisting  harm 
on  the  fighting  power  of  an  enemy.  Critically  impor¬ 
tant  military  computer  networks  are,  of  course,  acces¬ 
sible  neither  to  the  inspired  amateur  outsider,  nor  to 
the  malignant  political  enemy.  Easy  passing  reference 
to  a  hypothetical  "cyber  Pearl  Harbor"  reflects  both 
poor  history  and  ignorance  of  contemporary  military 
common  sense.  Critical  potential  military  (and  other) 
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targets  for  cyber  attack  are  extremely  hard  to  access 
and  influence  (I  believe  and  certainly  hope),  and  the 
technical  knowledge,  skills,  and  effort  required  to 
do  serious  harm  to  national  security  is  forbiddingly 
high.  This  is  not  to  claim,  foolishly,  that  cyber  means 
absolutely  could  not  secure  near-catastrophic  results. 
However,  it  is  to  say  that  such  a  scenario  is  extremely 
improbable.  Cyber  defense  is  advancing  all  the  time, 
as  is  cyber  offense,  of  course.  But  so  discretionary  in 
vital  detail  can  one  be  in  the  making  of  cyberspace, 
that  confidence  —  real  confidence  — in  cyber  attack 
could  not  plausibly  be  high.  It  should  be  noted  that 
I  am  confining  this  particular  discussion  to  what 
rather  idly  tends  to  be  called  cyber  war.  In  political 
and  strategic  practice,  it  is  unlikely  that  war  would  or, 
more  importantly,  ever  could  be  restricted  to  the  EMS. 
Somewhat  rhetorically,  one  should  pose  the  question: 
Is  it  likely  (almost  anything,  strictly,  is  possible)  that 
cyber  war  with  the  potential  to  inflict  catastrophic 
damage  would  be  allowed  to  stand  unsupported  in 
and  by  action  in  the  other  four  geographical  domains 
of  war?  I  believe  not. 

Because  we  have  told  ourselves  that  ours  uniquely 
is  the  Information  Age,  we  have  become  unduly  re¬ 
spectful  of  the  potency  of  this  rather  slippery  catch-all 
term.  As  usual,  it  is  helpful  to  contextualize  the  al¬ 
legedly  magical  ingredient,  information,  by  locating 
it  properly  in  strategic  history  as  just  one  important 
element  contributing  to  net  strategic  effectiveness. 
This  mild  caveat  is  supported  usefully  by  recognizing 
the  general  contemporary  rule  that  information  per  se 
harms  nothing  and  nobody.  The  electrons  in  cyber- 
ized  conflict  have  to  be  interpreted  and  acted  upon  by 
physical  forces  (including  agency  by  physical  human 
beings).  As  one  might  say,  intelligence  (alone)  sinks 
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no  ship;  only  men  and  machines  can  sink  ships!  That 
said,  there  is  no  doubt  that  if  friendly  cyber  action 
can  infiltrate  and  misinform  the  electronic  informa¬ 
tion  on  which  advisory  weaponry  and  other  machines 
depend,  considerable  warfighting  advantage  could  be 
gained.  I  do  not  intend  to  join  Clausewitz  in  his  dis¬ 
dain  for  intelligence,  but  I  will  argue  that  in  strategic 
affairs,  intelligence  usually  is  somewhat  uncertain.59 
Detailed  up-to-date  intelligence  literally  is  essential 
for  successful  cyber  offense,  but  it  can  be  healthily 
sobering  to  appreciate  that  the  strategic  rewards  of 
intelligence  often  are  considerably  exaggerated.  The 
basic  reason  is  not  hard  to  recognize.  Strategic  success 
is  a  complex  endeavor  that  requires  adequate  perfor¬ 
mances  by  many  necessary  contributors  at  every  level 
of  conflict  (from  the  political  to  the  tactical). 

When  thoroughly  reliable  intelligence  on  the  en¬ 
emy  is  in  short  supply,  which  usually  is  the  case,  the 
strategist  finds  ways  to  compensate  as  best  he  or  she 
can.  The  IT-led  RMA  of  the  past  2  decades  was  fueled 
in  part  by  the  prospect  of  a  quality  of  military  effec¬ 
tiveness  that  was  believed  to  flow  from  "dominant 
battle  space  knowledge,"  to  deploy  a  familiar  con¬ 
cept.60  While  there  is  much  to  be  said  in  praise  of  this 
idea,  it  is  not  unreasonable  to  ask  why  it  has  been  that 
our  ever-improving  battle  space  knowledge  has  been 
compatible  with  so  troubled  a  course  of  events  in  the 
2000s  in  Iraq  and  Afghanistan.  What  we  might  have 
misunderstood  is  not  the  value  of  knowledge,  or  of 
the  information  from  which  knowledge  is  quarried,  or 
even  the  merit  in  the  IT  that  passed  information  and 
knowledge  around.  Instead,  we  may  well  have  failed 
to  grasp  and  grip  understanding  of  the  whole  context 
of  war  and  strategy  for  which  battle  space  knowledge 
unquestionably  is  vital.  One  must  say  "vital"  rather 
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than  strictly  essential,  because  relatively  ignorant 
armies  can  and  have  fought  and  won  despite  their  ig¬ 
norance.  History  requires  only  that  one's  net  strategic 
performance  is  superior  to  that  of  the  enemy.  One  is 
not  required  to  be  deeply  well  informed  about  the  en¬ 
emy.  It  is  historically  quite  commonplace  for  armies  to 
fight  in  a  condition  of  more-than-marginal  reciprocal 
and  strategic  cultural  ignorance.  Intelligence  is  king  in 
electronic  warfare,  but  such  warfare  is  unlikely  to  be 
solely,  or  even  close  to  solely,  sovereign  in  war  and  its 
warfare,  considered  overall  as  they  should  be. 

4.  Why  the  sky  will  not  fall.  More  accurately,  one 
should  say  that  the  sky  will  not  fall  because  of  hostile 
action  against  us  in  cyberspace  unless  we  are  improb¬ 
ably  careless  and  foolish.  David  J.  Betz  and  Tim  Ste¬ 
vens  strike  the  right  note  when  they  conclude  that "  [i]f 
cyberspace  is  not  quite  the  hoped-for  Garden  of  Eden, 
it  is  also  not  quite  the  pestilential  swamp  of  the  imagi¬ 
nation  of  the  cyber-alarmists."61  Our  understanding  of 
cyber  is  high  at  the  technical  and  tactical  level,  but  re¬ 
mains  distinctly  rudimentary  as  one  ascends  through 
operations  to  the  more  rarified  altitudes  of  strategy 
and  policy.  Nonetheless,  our  scientific,  technological, 
and  tactical  knowledge  and  understanding  clearly  in¬ 
dicates  that  the  sky  is  not  falling  and  is  unlikely  to  fall 
in  the  future  as  a  result  of  hostile  cyber  action.  This 
analysis  has  weighed  the  more  technical  and  tactical 
literature  on  cyber  and  concludes,  not  simply  on  bal¬ 
ance,  that  cyber  alarmism  has  little  basis  save  in  the 
imagination  of  the  alarmists.  There  is  military  and 
civil  peril  in  the  hostile  use  of  cyber,  which  is  why 
we  must  take  cyber  security  seriously,  even  to  the 
point  of  buying  redundant  capabilities  for  a  range  of 
command  and  control  systems.62  So  seriously  should 
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we  regard  cyber  danger  that  it  is  only  prudent  to  as¬ 
sume  that  we  will  be  the  target  for  hostile  cyber  action 
in  future  conflicts,  and  that  some  of  that  action  will 
promote  disruption  and  uncertainty  in  the  damage  it 
will  cause. 

That  granted,  this  analysis  recommends  strongly 
that  the  U.S.  Army,  and  indeed  the  whole  of  the  U.S. 
Government,  should  strive  to  comprehend  cyber  in 
context.  Approached  in  isolation  as  a  new  technol¬ 
ogy,  it  is  not  unduly  hard  to  be  over  impressed  with 
its  potential  both  for  good  and  harm.  But  if  we  see 
networked  computing  as  just  the  latest  RMA  in  an 
episodic  succession  of  revolutionary  changes  in  the 
way  information  is  packaged  and  communicated,  the 
computer-led  IT  revolution  is  set  where  it  belongs,  in 
historical  context.  In  modern  strategic  history,  there 
has  been  only  one  truly  game-changing  basket  of  tech¬ 
nologies,  those  pertaining  to  the  creation  and  deliv¬ 
ery  of  nuclear  weapons.  Everything  else  has  altered 
the  tools  with  which  conflict  has  been  supported  and 
waged,  but  has  not  changed  the  game.  The  nuclear 
revolution  alone  raised  still-unanswered  questions 
about  the  viability  of  interstate  armed  conflict.  How¬ 
ever,  it  would  be  accurate  to  claim  that  since  1945, 
methods  have  been  found  to  pursue  fairly  traditional 
political  ends  in  ways  that  accommodate  nonuse  of 
nuclear  means,  notwithstanding  the  permanent  pres¬ 
ence  of  those  means. 

The  light  cast  by  general  strategic  theory  reveals 
what  requires  revealing  strategically  about  networked 
computers.  Once  one  sheds  some  of  the  sheer  wonder 
at  the  seeming  miracle  of  cyber's  ubiquity,  instanta- 
neity,  and  (near)  anonymity,  one  realizes  that  cyber 
is  just  another  operational  domain,  though  certainly 
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one  very  different  from  the  others  in  its  nonphysi- 
cality  in  direct  agency.  Having  placed  cyber  where 
it  belongs,  as  a  domain  of  war,  next  it  is  essential  to 
recognize  that  its  nonphysicality  compels  that  cyber 
should  be  treated  as  an  enabler  of  joint  action,  rather 
than  as  an  agent  of  military  action  capable  of  behav¬ 
ing  independently  for  useful  coercive  strategic  effect. 
There  are  stand-alone  possibilities  for  cyber  action, 
but  they  are  not  convincing  as  attractive  options  either 
for  or  in  opposition  to  a  great  power,  let  alone  a  super¬ 
power.  No  matter  how  intriguing  the  scenario  design 
for  cyber  war  strictly  or  for  cyber  warfare,  the  logic 
of  grand  and  military  strategy  and  a  common  sense 
fueled  by  understanding  of  the  course  of  strategic  his¬ 
tory,  require  one  so  to  contextualize  cyber  war  that  its 
independence  is  seen  as  too  close  to  absurd  to  merit 
much  concern. 

Because  cyber  threats,  unlike  nuclear  threats, 
should  not  be  able  to  menace  the  integrity  of  the  game 
table  on  which  politics  is  played  internationally,  there 
is  good  reason  to  endorse  the  proposition  that  the 
networked  computers  that  generate  cyber  power  are 
entirely  understandable  in  the  terms  long  made  famil¬ 
iar  to  us  in  the  pages  of  the  classic  books  on  strategy 
and  statecraft  written  by  Thucydides,  Clausewitz,  and 
Sun-Tzu.  Furthermore,  our  contemporary  troubles  in 
understanding  what  cyber  power  may  mean  strategi¬ 
cally  are  different  only  in  technical  and  tactical  char¬ 
acter  from  the  challenges  posed  by  past  RMAs.  Cyber 
is  different  in  its  character,  but  not  in  its  nature,  when 
it  is  approached  in  strategic  context. 
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APPENDIX 


THE  GENERAL  THEORY  OF  STRATEGY 
IN  22  DICTA* 

Nature  and  Character  of  Strategy. 

1.  Grand  strategy  is  the  direction  and  use  made  of 
any  or  all  of  the  assets  of  a  security  community,  in¬ 
cluding  its  military  instrument,  for  the  purposes  of 
policy  as  decided  by  politics. 

2.  Military  strategy  is  the  direction  and  use  made  of 
force  and  the  threat  of  force  for  the  purposes  of  policy 
as  decided  by  politics. 

3.  Strategy  is  the  only  bridge  built  and  held  to  con¬ 
nect  policy  purposefully  with  the  military  and  other 
instruments  of  power  and  influence. 

4.  Strategy  serves  politics  instrumentally  by  gener¬ 
ating  net  strategic  effect. 

5.  Strategy  is  adversarial;  it  functions  in  both  peace 
and  war,  and  it  always  seeks  a  measure  of  control  over 
enemies  (and  often  over  allies  and  neutrals,  also). 

6.  Strategy  usually  requires  deception,  very  fre¬ 
quently  is  ironic,  and  occasionally  is  paradoxical. 

7.  Strategy  is  pervasively  human. 

8.  The  meaning  and  character  of  strategies  are 
driven,  though  not  dictated  and  wholly  determined, 
by  their  contexts,  all  of  which  are  constantly  in  play 
and  can  realistically  be  understood  to  constitute  just 
one  compounded  super-context. 

9.  Strategy  has  a  permanent  nature,  while  strategies 
(usually  plans,  formal  or  informal,  expressing  contin¬ 
gent  operational  intentions)  have  a  variable  character, 
driven  but  not  mandated  by  their  unique  and  chang¬ 
ing  contexts,  the  needs  of  which  are  expressed  in  the 
decisions  of  individuals. 
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Making  Strategy. 


10.  Strategy  typically  is  made  by  a  process  of  dia¬ 
logue  and  negotiation. 

11.  Strategy  is  a  value  charged  zone  of  ideas  and 
behavior. 

12.  Historically  specific  strategies  often  are  driven, 
and  always  are  shaped,  by  culture  and  personality, 
while  strategy  in  general  theory  is  not. 

Executing  Strategy. 

13.  The  strategy  bridge  must  be  held  by  competent 
strategists. 

14.  Strategy  is  more  difficult  to  devise  and  execute 
than  are  policy,  operations,  and  tactics:  friction  of 
all  kinds  comprise  phenomena  inseparable  from  the 
making  and  execution  of  strategies. 

15.  The  structure  of  the  strategy  function  is  best 
explained  as  comprising  political  ends,  chosen  ways, 
and  enabling  means  (especially,  but  not  exclusively, 
military)  and  the  whole  endeavor  is  informed,  shaped, 
and  may  even  be  driven,  by  the  reigning  assumptions, 
both  those  that  are  recognized  and  those  that  are  not. 

16.  Strategy  can  be  expressed  in  strategies  that  are: 
direct  or  indirect;  sequential  or  cumulative;  attritional 
or  maneuverist-annihilating;  persisting  or  raiding 
(more  or  less  expeditionary);  or  a  complex  combina¬ 
tion  of  these  nominal  alternatives. 

17.  All  strategies  are  shaped  by  their  particular 
geographical  contexts,  but  strategy  itself  is  not. 

18.  Strategy  is  an  unchanging,  indeed  unchange¬ 
able,  human  activity  in  thought  and  behavior,  set  in  a 
variably  dynamic  technological  context. 
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19.  Unlike  strategy,  all  strategies  are  temporal. 

20.  Strategy  is  logistical. 

21.  Strategic  theory  is  the  fundamental  source  of 
military  doctrine,  while  doctrine  is  a  notable  enabler 
of,  and  guide  for,  strategies. 

Consequences  of  Strategy. 

22.  All  military  behavior  is  tactical  in  execution, 
but  must  have  operational  and  strategic  effect,  intend¬ 
ed  and  otherwise. 

*This  Appendix  is  provided  with  the  permission  of  Oxford 
University  Press.  It  is  published  in  Colin  S.  Gray,  Perspectives  on 
Strategy,  Oxford,  UK:  Oxford  University  Press,  2013,  p.  13. 
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